Apache Answer contains a Missing Authorization flaw that affects its MCP answer retrieval tool. The vulnerability allows holders of a global API key to retrieve answer content that is associated with questions marked as hidden, deleted, or pending review. This could expose confidential or unpublished information to unauthorized parties, representing a clear confidentiality breach. The flaw is exploitable through the public API; an attacker with a valid global key can simply make the same request that a legitimate user would use to read an answer. No authentication checks are performed against the visibility status of the question, enabling the disclosure of content that should remain private. The CVE entry reports a CVSS score of 4.3, an EPSS score of < 1%, and it is not listed in the CISA KEV catalog. The described impact of revealing non-public content suggests a significant risk to data confidentiality for organizations using Apache Answer.

Apache Software Foundation’s Apache Answer, versions up through 2.0.2 are affected. Upgrading to 2.0.3 or later resolves the issue.

The vulnerability can be exploited remotely via the API by any bearer of a global key. Because the flaw is a missing authorization check, it allows an attacker to bypass normal access controls and retrieve private data. The CVSS score of 4.3 indicates a low severity. The EPSS score is less than 1%, indicating a low probability of exploitation. KEV does not list it, so the public exploitation likelihood remains low, but the potential for confidentiality loss remains high, especially where global keys are widely shared.