PUBLISHED
2026-08-05 16:16
MODIFIED
2026-08-05 16:16
EPSS (Prob. Exploit)
0.47%
Top 59.3%
> DESCRIPTION
Improper Input Validation vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.1.
A missing ownership check in the avatar-cleanup logic allows any authenticated user to delete other users' uploaded files by supplying their file URLs.
Users are recommended to upgrade to version 2.0.2, which fixes the issue.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
> CWE DETAILED DESCRIPTIONS
CWE-639: Authorization Bypass Through User-Controlled Key - The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)
Apache Answer: Improper authorization in avatar update cleanup allows authenticated users to delete arbitrary uploaded files by URL
AFFECTED PACKAGES:
Unknown / Unknown
28 versions affected
> HISTORIQUE DES MODIFICATIONS
Première apparition
05/08/2026 16:16
Source: NVD
📊
ENRICHISSEMENT
01/09/2026 06:02
CWE
Champ modifié: Description CWE
Nouvelle valeur:
CWE-639: Authorization Bypass Through User-Controlled Key - The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key...
Total des modifications: 1
Dernière mise à jour: 2 months ago