7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24735

CVE-2026-24735: Apache Answer: Revision API Improper Access Control leads to Information Disclosure

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer.

This issue affects Apache Answer: through 1.7.1.

An unauthenticated API endpoint incorrectly exposes full revision history for deleted content. This allows unauthorized user to retrieve restricted or sensitive information. Users are recommended to upgrade to version 2.0.0, which fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24735

CVE-2026-24735:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/apache/answer	go	<= 1.7.1	2.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, as described, allows an unauthenticated user to access the revision history of deleted content. My analysis of the commits between the vulnerable version (1.7.1) and the patched version (2.0.0) revealed a key commit (9ea13af8606976a447e6f3b416c325627ee4fa79) that directly addresses this issue.

The patch does two main things:

It moves the /revisions API endpoint from an unauthenticated router group (RegisterUnAuthAnswerAPIRouter) to an authenticated one (RegisterAnswerAPIRouter). This change makes the RevisionController.GetRevisionList function, which handles this endpoint, require authentication.
It adds a crucial security check within the RevisionService.GetRevisionList function. This new logic fetches the object's metadata, checks if it's deleted, and if the user is not an administrator or the original author, it returns a 'Not Found' error. This prevents the disclosure of revision history for deleted content to unauthorized users.

Therefore, the vulnerable functions are RevisionController.GetRevisionList, which was the insecure entry point, and RevisionService.GetRevisionList, which contained the flawed logic that failed to perform necessary authorization checks before exposing potentially sensitive data.

Vulnerable functions

RevisionController.GetRevisionList

internal/controller/revision_controller.go

This controller function was exposed via an unauthenticated API endpoint (`/revisions`). It handled requests for revision history without performing any authentication or authorization checks, directly calling the service layer with the user-provided object ID. This allowed unauthorized users to access the revision history of any object, including deleted ones.

RevisionService.GetRevisionList

internal/service/content/revision_service.go

This service function contained the core logic for fetching revision history. Prior to the patch, it retrieved and returned all revisions for a given object ID without verifying the object's status (e.g., deleted) or the user's permissions. An attacker could exploit this by providing the ID of a deleted post, causing the function to return its entire revision history, which might contain sensitive information.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.