Improper Input Validation in Apache Answer by Apache
CVE-2026-48912

6.5MEDIUM

Key Information:

Vendor

Apache
Status
Apache Answer
Vendor
CVE Published:
5 August 2026

What is CVE-2026-48912?

An improper input validation vulnerability exists in Apache Answer, specifically impacting version 2.0.1. This flaw allows authenticated users to bypass ownership checks during the avatar-cleanup process, potentially leading to unauthorized deletion of other users' uploaded files by manipulating their file URLs. Users are strongly encouraged to upgrade to version 2.0.2 to mitigate this risk and safeguard their data.

Affected Version(s)

Apache Answer 0 <= 2.0.1

References

https://lists.apache.org/thread/b9jnttmspd9kp4vgbvb32dcqb...
vendor-advisory

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

tonghuaroot
.