The vulnerability in Apache Answer enables an unauthenticated user to retrieve comments attached to content marked as non‑public by visiting publicly accessible user profiles. The exposed data consists of the comment text and its metadata, which can reveal private discussions or user interactions that were intended to remain confidential.

Apache Answer versions up to and including 2.0.2 are affected. The flaw originates in the public profile endpoint that does not enforce visibility checks for comments on non‑public content.

The flaw can be exploited without authentication by accessing a publicly reachable profile page; this is inferred as the likely attack vector. With a CVSS score of 5.3, the vulnerability is classified as moderate severity, indicating realistic risk to confidentiality of non‑public comments. The EPSS score is `< 1%` and the vulnerability is not listed in CISA KEV, which suggests a low likelihood of exploitation but still requires attention when protecting private content.