Apache Answer has a missing visibility authorization check that allows anyone to retrieve the list of users invited to a non-public question. The unauthorized disclosure reveals which users were invited, compromising confidentiality and potentially exposing sensitive collaboration details. The underlying weakness is categorised as an improper authorization flaw (CWE-862).

The affected system is the Apache Answer platform. All releases through version 2.0.2 are vulnerable. Newer releases, starting with 2.0.3, contain the fix.

Based on the description, an attacker does not need credentials to send a request to the invite‑lookup endpoint for a private question, which will return the invited user list. However, the EPSS score of <1% indicates that the likelihood of successful exploitation in the wild is very low. The CVSS score of 5.3 reflects moderate severity and the potential for confidentiality impact. The vulnerability is not in the CISA KEV catalogue, but organizations should still patch to eliminate the possibility of unauthorized disclosure.