Apache Answer CVE-2026-48912

Exploitation requires a valid authenticated session on the target Apache Answer instance - any user account suffices, including self-registered accounts on open community instances. The attacker must be able to obtain or guess the file URL of a victim's uploaded file; in practice, avatar URLs are exposed on public profile pages and in API responses. The vulnerability is limited to the avatar-cleanup endpoint and affects only file deletion, not reading, modifying, or executing files. Exploitation is constrained to instances running Apache Answer 2.0.1 or earlier. Instances that restrict self-registration to invited or verified users have a significantly reduced attacker pool, as external unauthenticated attackers cannot reach the vulnerable endpoint.

No vendor-provided CVSS vector is available, so risk signals are limited to the description, CWE classification, and advisory. Based on independent assessment, this is a network-exploitable, low-complexity flaw requiring only a standard user account (PR:L), placing it at approximately CVSS 5.4 Medium. The practical impact is targeted file deletion - specifically uploaded avatars or user files - rather than code execution or data exfiltration, which caps the severity ceiling. No EPSS score is available, and this CVE is not listed in the CISA KEV catalog, so widespread active exploitation is not confirmed. The most realistic threat actor is a malicious registered user (e.g., on a community Q&A instance open to registration) or an attacker with a compromised low-privilege account seeking to disrupt other users. Organizations running private, internally-authenticated instances face lower exposure because the attacker pool is limited to internal users.

An attacker registers or logs into any valid Apache Answer account on a target instance. They retrieve the file URL for another user's uploaded avatar - obtainable from the victim's public profile or via API response - and submit a crafted avatar-cleanup request supplying that URL. The server deletes the victim's file without checking ownership, resulting in silent loss of the victim's uploaded content.