CVE-2026-50749
published 2026-08-05CVE-2026-50749: Improper Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Any authenticated user can reject arbitrary pending…
PriorityP340medium6.5CVSS 3.1
AVNACLPRLUINSUCNIHAN
EPSS
0.47%
39.7th percentile
Improper Authorization vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.1.
Any authenticated user can reject arbitrary pending edit-revisions without review permission due to a missing authorization check on the reject operation.
Users are recommended to upgrade to version 2.0.2, which fixes the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | answer | < 2.0.2 | 2.0.2 |
| apache_software_foundation | apache_answer | <= 2.0.1 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Apache Answer up to 2.0.1 improper authorization (EUVD-2026-53400)
vuldb·2026-08-06·CVSS 6.5
CVE-2026-50749 [MEDIUM] Apache Answer up to 2.0.1 improper authorization (EUVD-2026-53400)
A vulnerability marked as problematic has been reported in Apache Answer up to 2.0.1. Affected by this vulnerability is an unknown functionality. The manipulation leads to improper authorization.
This vulnerability is listed as CVE-2026-50749. The attack may be initiated remotely. There is no available exploit.
It is suggested to upgrade the affected component.
GHSA
Improper Authorization vulnerability in Apache Answer.
ghsa_unreviewed·2026-08-05
CVE-2026-50749 CWE-863 Improper Authorization vulnerability in Apache Answer.
Improper Authorization vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.1.
Any authenticated user can reject arbitrary pending edit-revisions without review permission due to a missing authorization check on the reject operation.
Users are recommended to upgrade to version 2.0.2, which fixes the issue.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-05
Published