Apache Answer contains an improper authorization check in the similar‑question search functionality, allowing any authenticated user to retrieve metadata for questions that are not publicly visible. This flaw results in the disclosure of non‑public question metadata, violating confidentiality and potentially exposing sensitive research or user data. The weakness is classified as an authorization failure (CWE‑202).

Affected systems include Apache Answer deployments with version numbers up to and including 2.0.2. Versions 2.0.3 and later include the fix and are not vulnerable.

The CVSS score is not publicly listed, and EPSS is unavailable, but the vulnerability remains serious because it can expose detailed question metadata to any authenticated user. The flaw is not listed in CISA's KEV catalog, indicating no publicly known exploits at this time. The likely attack vector involves an attacker first becoming an authenticated user of the platform and then exploiting the similar‑question search to access restricted metadata. Due to the absence of a publicly available exploit, the risk is primarily mitigated by preventing the flaw rather than through detection of malicious activity.