Apache Answer CVE-2026-50749

Exploitation requires an active authenticated session on the Apache Answer instance - no anonymous exploitation is possible. The attacker must be a registered user on the platform; no elevated role or privilege is needed beyond standard membership. The target must have at least one pending edit-revision in the moderation queue. Exploitation is limited to Apache Answer versions 2.0.1 and earlier; instances already upgraded to 2.0.2 are not affected. The impact is strictly scoped to the edit-revision workflow - file system access, code execution, and data exfiltration are not achievable through this vulnerability.

Real-world impact is moderate and bounded. The vulnerability requires authentication (PR:L inferred from the description stating 'any authenticated user'), limiting exposure to registered community members rather than anonymous attackers. The integrity impact is confined to content moderation - attackers can reject valid community edits but cannot read private data or execute code. No CVSS score was published by NVD at time of analysis, no EPSS data is available, and no SSVC signals (automatable mass exploitation, lateral movement) are present. The absence of KEV listing and public POC further limits urgency. This is a genuine access-control defect but not a high-priority emergency for most operators - the primary risk is abuse by disgruntled community members or automated accounts to suppress legitimate edits.

An authenticated Apache Answer community member with no reviewer role navigates to a pending edit-revision submitted by another user and calls the reject endpoint directly (e.g., via a crafted API request), bypassing the UI restriction that hides the button for non-reviewers. Because the server-side authorization check is absent, the rejection is processed, suppressing the legitimate edit without any reviewer approval. No exploit code or proof-of-concept has been publicly identified at time of analysis.