What is the CVSS score of CVE-2026-48912?

CVE-2026-48912 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Apache Answer CVE-2026-48912

EUVD-2026-53399 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-05 apache

GHSA-536r-pphc-ghq8

Authentication Bypass Apache Apache Answer Apache Software Foundation

6.5

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

5.4 MEDIUM

Network-reachable endpoint, no complexity; requires only a low-privilege authenticated session; impact is limited to deleting others' files - integrity and availability loss, no confidentiality breach.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

CVSS changed

Aug 06, 2026 - 15:22 NVD

6.5 (MEDIUM)

Analysis Generated

Aug 05, 2026 - 15:50 vuln.today

DescriptionCVE.org

Improper Input Validation vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.1.

A missing ownership check in the avatar-cleanup logic allows any authenticated user to delete other users' uploaded files by supplying their file URLs. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

AnalysisAI

Insecure Direct Object Reference (IDOR) in Apache Answer through version 2.0.1 allows any authenticated user to delete uploaded files belonging to other users by supplying arbitrary file URLs to the avatar-cleanup endpoint. The root cause is a missing ownership check in the file-deletion logic (CWE-639), meaning the application accepts a user-controlled file URL and acts on it without verifying the requesting user has authority over that resource. No public exploit has been identified at time of analysis, but the attack requires only a valid account, making it low-friction once an attacker has registered or compromised any user.

Technical ContextAI

CWE-639 (Authorization Bypass Through User-Controlled Key) describes a class of IDOR flaws where an application uses a value supplied directly by the user - here, a file URL - as the key for an authorization decision without validating ownership. Apache Answer (CPE: cpe:2.3:a:apache_software_foundation:apache_answer:*:*:*:*:*:*:*:*) is an open-source Q&A community platform. Its avatar-cleanup routine accepts a file URL as input and deletes the referenced file from storage, but fails to confirm that the authenticated requester owns the file. Because file URLs in web applications are typically predictable or discoverable (e.g., stored in user profile data or enumerable from the API), any registered user can construct a valid deletion request targeting another user's uploaded content.

RemediationAI

Upgrade to Apache Answer 2.0.2, which adds ownership validation to the avatar-cleanup logic and directly resolves this vulnerability. The vendor advisory is available at https://lists.apache.org/thread/b9jnttmspd9kp4vgbvb32dcqb4201flq. If an immediate upgrade is not feasible, compensating controls include restricting account registration to trusted users only (to shrink the pool of potential attackers), reviewing access logs for anomalous file-deletion activity against the avatar-cleanup endpoint, and temporarily disabling the avatar-upload or cleanup feature if the application configuration permits it - note that disabling this feature may degrade user experience but does not otherwise affect core Q&A functionality. There are no known side effects to the 2.0.2 patch beyond the intended ownership enforcement.