An unauthenticated API endpoint in Apache Answer incorrectly exposes the full revision history for deleted content, allowing an unauthorized user to retrieve restricted or sensitive personal information. This flaw is identified as CWE‑359 (Information Exposure Through an Insecure API), leading to the leakage of private data. The vulnerability does not allow code execution or system compromise, but the data exposed can be highly confidential to users of the platform.

The vulnerability affects all Apache Answer releases up to and including version 1.7.1. Users running these versions are exposed to the insecure revision history endpoint. Upgrading to version 2.0.0 or later resolves the issue and removes the exposed endpoint.

The vulnerability carries a CVSS score of 7.5, indicating a high likelihood of impact if exploited. The EPSS score is less than 1%, suggesting a low probability that attackers currently target this weakness. The CVE is not listed in the CISA KEV catalog. Attackers can reach the vulnerable endpoint without authentication, simply by sending an HTTP request to the revision API; no special privileges or credentials are required. Because the attack vector relies solely on a publicly available endpoint, it is straightforward to exploit in the absence of additional protective controls.