The vulnerability in Apache Answer enables an unauthenticated user to retrieve comments attached to content marked as non‑public by visiting publicly accessible user profiles. The exposed data consists of the comment text and its metadata, which can reveal private discussions or user interactions that were intended to remain confidential.

Apache Answer versions up to and including 2.0.2 are affected. The flaw originates in the public profile endpoint that does not enforce visibility checks for comments on non‑public content.

The flaw can be exploited without authentication by accessing a publicly reachable profile page; this is inferred as the likely attack vector. Because no CVSS score is provided, the exact severity cannot be quantified, and the EPSS score is unavailable, the vulnerability is not listed in CISA KEV. Consequently, while the exposure carries a privacy risk, the lack of exploitation data suggests a moderate threat level for organizations that rely heavily on content isolation.