CVE-2026-48912

CVE-2026-48912: Apache Answer: Improper authorization in avatar update cleanup allows authenticated users to delete arbitrary uploaded files by URL

Vendor Apache Software Foundation

Product Apache Answer

Weakness CWE-639 · IDOR

Published August 5, 2026

Last update August 5, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Improper Input Validation vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing ownership check in the avatar-cleanup logic allows any authenticated user to delete other users' uploaded files by supplying their file URLs. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

Key dates

02Disclosure timeline

August 5, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-48912 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/639.html AskarLabs — CWE-639 write-up Authorization Bypass Through User-Controlled Key

Related vulnerabilities

04Related CVE

CVE-2026-10630 WP Courses LMS <= 3.2.29 - Insecure Direct Object Reference to Authenticated (Custom+) Sensitive Information Disclosure via 'resultID' Parameter CVE-2026-57680 WordPress Kirki plugin <= 6.0.11 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-12418 User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.7 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Modification via 'wpuf_files_data' Parameter CVE-2026-1291 Meow Gallery <= 5.4.4 - Missing Authorization to Authenticated (Author+) Shortcode creation CVE-2026-28155 WordPress Do Lasso plugin <= 358 - Insecure Direct Object References (IDOR) vulnerability