VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Aug 5, 2026· Updated Aug 6, 2026

CVE-2026-48912

CVE-2026-48912

Description

Improper Input Validation vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.1.

A missing ownership check in the avatar-cleanup logic allows any authenticated user to delete other users' uploaded files by supplying their file URLs. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Apache/Answer2 versions
    cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*range: <2.0.2
    • (no CPE)range: <=2.0.1

Patches

Vulnerability mechanics

References

2

News mentions

1