The vulnerability originates from missing authorization checks on timeline-related API endpoints in Apache Answer. This flaw allows any authenticated user to view content that has been deleted, marked private, or remains unapproved, along with its revision history. Consequently, private personal information can be exposed to users who should not have access to it.

Apache Answer versions 2.0.0 and earlier are vulnerable. The issue is fixed in release 2.0.1, so all installations of Apache Answer that have not upgraded to 2.0.1 are at risk.

Because the weakness is a straightforward lack of authorization (CWE-359), an attacker only needs to authenticate with a user account and correctly format a request to a timeline API endpoint; no additional special circumstances are required. The CVSS score for this vulnerability is 6.1, which is considered medium severity. The EPSS score is less than 1%, indicating a very low probability of exploitation. The vulnerability has not yet been reported in CISA's KEV catalog. However, the impact on confidentiality of private data and the ease of exploitation suggest a high risk that warrants immediate remediation.