Attackers can retrieve metadata from hidden questions without authentication, exposing sensitive information about those questions to anyone who can view a public answer profile. The flaw enables a confidentiality breach that directly violates the principle of least privilege and is classified as an information disclosure weakness (CWE-200).

The vulnerability is present in Apache Answer versions through 2.0.2. Any deployments of those builds that expose answer profiles publicly are affected.

The CVSS score is not provided in the advisory, and EPSS data is unavailable, so the exact numerical severity cannot be quantified here. However, the flaw is exploitable in any environment that permits unauthenticated access to public answer profiles, a scenario that is generally common for web‐based content services. Because the data exposed can reveal context or subjects of hidden questions, the potential impact on the confidentiality of user data is significant. The vulnerability is not listed in CISA's KEV catalog at this time, but its risk is still elevated due to the ease of exploitation and the sensitive nature of the data revealed.