What happened
Apache disclosed (2026-10-19) a missing-authorization flaw in the MCP answer retrieval tool of Apache Answer, allowing global API-key holders to access answer content of hidden, deleted, or pending-review questions. No CVSS score published (unrated).
Why it matters
Apache Answer exposes an MCP tool that agents call to retrieve knowledge-base answers. A missing visibility check in the MCP path leaks the same content the normal UI hides, letting an agent or its operator read data that should be restricted, and undermining the confidentiality boundary on the Q&A content that agents ingest.
Attack vector
The MCP answer retrieval tool does not enforce the same visibility/authorization rules as the web answers listing, so a caller holding a global API key can read answers associated with hidden, deleted, or pending-review questions (CWE-862).
Affected systems
Apache Answer through 2.0.2
Mitigation
Upgrade to Apache Answer 2.0.3.