CVE-2026-76994: Apache Answer exposes metadata of hidden questions through public answer profiles
A moderate-severity flaw in Apache Answer up to version 2.0.2 let unauthenticated attackers obtain metadata of hidden questions through public answer profiles. The fix is in version 2.0.3, according to the advisory posted to the oss-sec list on 15 October.
The advisory describes CVE-2026-76994, an information exposure vulnerability in Apache Answer, a question and answer platform. According to the text, unauthenticated attackers could obtain metadata associated with hidden questions through public answer profiles. The severity is rated moderate. Versions up to 2.0.2 are affected, and the advisory recommends updating to version 2.0.3, which fixes the problem.
The report was posted to the oss-sec mailing list on 15 October and was machine-translated for this source. The credit line names a reporter identified only by a handle. To check the details, consult the original text on the oss-sec list at the date stated, and compare it with the official Apache Answer release notes before applying the update.
Rota Nacional does not patch or manage third-party software, and this flaw does not come from any platform feature. If your organization runs an Apache Answer instance, the required action is to update that software itself.