VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Aug 5, 2026· Updated Oct 23, 2026

CVE-2026-48912

CVE-2026-48912

Description

Improper Input Validation vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.1.

A missing ownership check in the avatar-cleanup logic allows any authenticated user to delete other users' uploaded files by supplying their file URLs. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Apache/Answerllm-fuzzy2 versions
    <=2.0.1+ 1 more
    • (no CPE)range: <=2.0.1
    • cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*range: <2.0.2

Patches

Vulnerability mechanics

References

2

News mentions

1