CVE-2026-48912

Improper Input Validation vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing ownership check in the avatar-cleanup logic allows any authenticated user to delete other users' uploaded files by supplying their file URLs. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/b9jnttmspd9kp4vgbvb32dcqb4201flq	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/05/11	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de validación de entrada incorrecta en Apache Answer. Este problema afecta a Apache Answer: hasta la versión 2.0.1. Una comprobación de propiedad faltante en la lógica de limpieza de avatares permite a cualquier usuario autenticado eliminar archivos subidos por otros usuarios proporcionando sus URL de archivo. Se recomienda a los usuarios actualizar a la versión 2.0.2, que soluciona el problema.

Information

Published : 2026-08-05 16:16

Updated : 2026-10-24 16:10

NVD link : CVE-2026-48912

Mitre link : CVE-2026-48912

CVE.ORG link : CVE-2026-48912

JSON object : View

Products Affected

apache

answer

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-48912", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48912", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T14:37:35.646936Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Answer", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.0.1"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-05T16:16:57.213", "references": [{"url": "https://lists.apache.org/thread/b9jnttmspd9kp4vgbvb32dcqb4201flq", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/08/05/11", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Improper Input Validation vulnerability in Apache Answer.\n\nThis issue affects Apache Answer: through 2.0.1.\n\n A missing ownership check in the avatar-cleanup logic allows any authenticated user to delete other users' uploaded files by supplying their file URLs.\nUsers are recommended to upgrade to version 2.0.2, which fixes the issue."}, {"lang": "es", "value": "Vulnerabilidad de validaci\u00f3n de entrada incorrecta en Apache Answer.\n\nEste problema afecta a Apache Answer: hasta la versi\u00f3n 2.0.1.\n\nUna comprobaci\u00f3n de propiedad faltante en la l\u00f3gica de limpieza de avatares permite a cualquier usuario autenticado eliminar archivos subidos por otros usuarios proporcionando sus URL de archivo.\nSe recomienda a los usuarios actualizar a la versi\u00f3n 2.0.2, que soluciona el problema."}], "lastModified": "2026-10-24T16:10:00.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5584F84D-4A07-42B6-8380-4DBD2C81D87B", "versionEndExcluding": "2.0.2"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}