Apache Answer CVE-2026-86589

Requires the Apache Answer 'User Center' login integration to be configured and in use - the flaw lives in that integration's session creation path. The preconditions are: (1) a user authenticates via User Center and receives a session whose external identity is omitted; (2) that user's account is subsequently suspended or deleted at the central User Center; and (3) the stale session has not yet expired or been manually revoked. Limiting factors: the issue only matters when central suspension/deletion is relied upon as an enforcement mechanism, the affected actor must already hold a valid pre-suspension session (not an anonymous attacker), and the window closes automatically on session expiry or manual revocation. Deployments not using the User Center integration are unaffected.

This is a moderate-severity access-control weakness, not a high-urgency remote code execution issue. No CVSS vector, EPSS score, KEV listing, or POC was provided in the input, so the only authoritative severity signal is the vendor/Apache rating of 'moderate'. Exploitation status is 'no public exploit identified at time of analysis'. The flaw is an authentication/session-handling logic error: after a user's first login through the User Center integration, the created session omits the external identity, so later requests skip the central suspension/deletion check and the account retains access until the session naturally expires or is manually revoked. This is only meaningful in deployments that actually use the User Center integration and that rely on central suspension/deletion as a security control, which sharply narrows the real-world exposure. Authentication requirements cannot be confirmed from a CVSS vector because none was supplied; however, the scenario inherently involves an actor who already holds a legitimate (now-suspended) session rather than an anonymous outsider. Net assessment: a real but bounded integrity/availability-of-control issue - patch on normal cycle, prioritize if you depend on Answer's User Center integration for offboarding or ban enforcement. Verify affected-version scope with the Apache advisory, as the only machine-readable reference is the oss-security post.

An organization uses Apache Answer with the User Center integration and suspends or deletes a user's account centrally (e.g., during offboarding or a ban). Because that user's existing first-login session was created without its external identity, their already-authenticated browser session continues to pass authorization checks and access the platform until the session expires or an admin manually revokes it. No public exploit code is known; the condition is triggered simply by the suspended user continuing to use a still-valid session.