What is the CVSS score of CVE-2026-50749?

CVE-2026-50749 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Apache Answer are affected by CVE-2026-50749?

Apache Answer versions through 2.0.1 contain an authorization bypass that allows authenticated users to reject pending edit-revisions regardless of permissions, undermining content governance…

How to fix or mitigate CVE-2026-50749?

Within 24 hours, inventory all systems running Apache Answer through 2.0.1 and restrict system access to trusted administrators, disable or require administrative approval for edit-revision rejections, and enable detailed audit logging on all revision activities. Within 7 days, implement role-based access controls to enforce authorization on rejection operations and establish monitoring for unauthorized rejection attempts. Within 30 days, monitor the Apache Answer project for security patch releases, maintain upgrade readiness, and develop a testing and deployment plan for when patches become available.

Apache Answer CVE-2026-50749

EUVD-2026-53400 MEDIUM

Incorrect Authorization (CWE-863)

2026-08-05 apache

GHSA-47c3-m797-88v2

Apache Authentication Bypass Apache Answer

6.5

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

6.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible web app, low complexity; PR:L because any authenticated user exploits it; only integrity impact via unauthorized rejection of revisions.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

CVSS changed

Aug 06, 2026 - 16:22 NVD

6.5 (MEDIUM)

Analysis Generated

Aug 05, 2026 - 15:47 vuln.today

CVE Published

Aug 05, 2026 - 15:11 cve.org

HIGH

DescriptionCVE.org

Improper Authorization vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.1.

Any authenticated user can reject arbitrary pending edit-revisions without review permission due to a missing authorization check on the reject operation. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

AnalysisAI

Improper authorization in Apache Answer through version 2.0.1 allows any authenticated user to reject arbitrary pending edit-revisions without holding review permissions. The missing authorization check on the reject operation means content moderation controls are effectively bypassed by ordinary users, enabling disruption of the peer-review workflow. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Technical ContextAI

Apache Answer is a Q&A community platform (CPE: cpe:2.3:a:apache_software_foundation:apache_answer). The vulnerability is classified as CWE-863 (Incorrect Authorization), meaning the application performs an authorization check for some operations (e.g., approving revisions) but omits the equivalent check for the reject operation. This is a classic incomplete mediation pattern: the access control enforcement is inconsistently applied across related actions within the same feature, allowing a lesser-privileged user to exercise a capability that should be gated behind a review role.

RemediationAI

Upgrade Apache Answer to version 2.0.2, which corrects the missing authorization check on the reject-revision operation per the vendor advisory at https://lists.apache.org/thread/ogk461yr4w9o95k15bkjxk2kpbkrbnln. If an immediate upgrade is not feasible, a compensating control is to temporarily disable or restrict the edit-revision submission feature so that no pending revisions accumulate that could be improperly rejected. Alternatively, administrators can audit the reject-action audit log to identify and reverse any improperly processed rejections made by non-reviewer accounts. Neither workaround eliminates the authorization gap - patching to 2.0.2 is the only complete fix.