Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-50749: Apache Answer lets any logged‑in user reject pending edits

CVE-2026-50749 · published 3 months ago

Summary

The Apache Answer platform (up to version 2.0.1) allows any user who is signed in to discard pending changes without proper permission. This could let unauthorized people remove edits that should be reviewed. Upgrade to version 2.0.2 to restore proper access controls.

What to do

Update apache answer to version 2.0.2 or later.

Affected software

Vendor	Product	Affected versions
apache software foundation	apache answer	<= 2.0.1
apache	answer	< 2.0.2 `cpe:2.3:a:apache:answer::::::::`

Original advisory text

Apache Answer: Missing authorization in revision audit reject allows authenticated users to reject pending revisions

Improper Authorization vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.1.

Any authenticated user can reject arbitrary pending edit-revisions without review permission due to a missing authorization check on the reject operation.
Users are recommended to upgrade to version 2.0.2, which fixes the issue.

References

http://www.openwall.com/lists/oss-security/2026/08/05/12 URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50749... Vendor Advisory
https://lists.apache.org/thread/ogk461yr4w9o95k15bkjxk2kpbkrbnln Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-50749 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.5 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-863Incorrect Authorization

Timeline

Published5 Aug 2026

Updated4 Nov 2026

First seen5 Aug 2026

Sources

CVE-2026-50749 · NVD

CVE-2026-50749 · MITRE

CVE-2026-50749 · OSV

Track software like this

Free during beta