6.5Media
CVE-2026-50749Apache Answer: Missing authorization in revision audit reject allows authenticated users to reject pending revisions
Descripción
Improper Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Any authenticated user can reject arbitrary pending edit-revisions without review permission due to a missing authorization check on the reject operation. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
Debilidad (CWE):
CWE-863
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| apache | answer | < 2.0.2 | |
| Apache Software Foundation | Apache Answer | ≤ 2.0.1 |
Referencias y parches
- https://lists.apache.org/thread/ogk461yr4w9o95k15bkjxk2kpbkrbnln vendor-advisoryMailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2026/08/05/12 Mailing ListThird Party Advisory
Coincidencias CPE (NVD) (1)
cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*< 2.0.2