CVE-2026-60023 is an information disclosure vulnerability in Apache Answer versions 2.0.0 through 2.0.1. The single-answer retrieval endpoint (GET /answer/{id}) checks question visibility but does not check the answer's own status—deleted, pending, or visible. This means a requester with knowledge of an answer ID can retrieve answers that have been soft-deleted or are in pending moderation state, even when those answers do not appear in any list view or feed.
The root cause is an implicit authorization model where developers assumed answer visibility inherits from question visibility. When a question is visible, its answers should be accessible—this is true in the happy path but breaks for answers with independent status flags. The fix in 2.0.2 adds an explicit answer-status check to the retrieval path, making authorization a first-class concern for the answer entity rather than a derived property of its parent.
What you should check: First, verify you are on version 2.0.2 or later. Second, audit your answer retrieval endpoints beyond the primary path—search results, user activity feeds, admin exports, and any API that returns answer content by ID may use the same implicit inheritance model and skip the answer-status gate. If your codebase has a centralized authorization layer for answer access, confirm it evaluates answer-level state directly rather than delegating to question-level checks.
The deeper concern is architectural. The 2.0.2 patch likely closed one specific retrieval path, but if the codebase treats question visibility as a proxy for answer authorization elsewhere, sibling vulnerabilities likely exist. Deleted answers in a Q&A platform often contain the most sensitive content—moderation disputes, security drafts, internal references—which makes this less a generic disclosure and more a targeted exception-case leak. Treat this as a signal to audit your entire answer access surface, not just the reported endpoint.