CVE-2026-48912

Analyzed Analyzed - Analysis Complete

Improper Input Validation in Apache Answer

Publication date: 2026-08-05

Last updated on: 2026-08-06

Assigner: Apache Software Foundation

Description

Improper Input Validation vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing ownership check in the avatar-cleanup logic allows any authenticated user to delete other users' uploaded files by supplying their file URLs. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-06

Generated

2026-08-25

AI Q&A

2026-08-05

EPSS Evaluated

2026-08-24

NVD

CVE-2026-48912

EUVD

EUVD-2026-53399

Affected Vendors & Products

Vendor	Product	Version / Range
apache	answer	to 2.0.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an Improper Input Validation issue in Apache Answer versions up to 2.0.1. It allows any authenticated user to delete files uploaded by other users by providing their file URLs due to a missing ownership check in the avatar-cleanup logic.

Detection Guidance

This vulnerability involves improper input validation in Apache Answer's avatar cleanup logic. To detect it, check for unauthorized file deletions in logs or file systems. Look for requests to delete files where the user ID does not match the file owner. Monitor Apache Answer's access logs for suspicious DELETE operations on avatar URLs.

Impact Analysis

An attacker could delete other users' uploaded files, leading to data loss or disruption of service. This could affect user experience and trust in the platform.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized file deletion. If user-uploaded files contain sensitive data, their deletion could violate data integrity requirements under these regulations.

Mitigation Strategies

Upgrade Apache Answer to version 2.0.2 or later to fix the improper input validation issue in the avatar-cleanup logic.

Hi! I’m here to help you understand CVE-2026-48912. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70