CVE-2026-50749: Apache Answer Auth Bypass Vulnerability

CVE-2026-50749 Overview

CVE-2026-50749 is an improper authorization vulnerability in Apache Answer, an open-source Q&A platform. The flaw affects all versions through 2.0.1. Any authenticated user can reject arbitrary pending edit-revisions without holding review permission. The reject operation is missing an authorization check on the server side. This weakness maps to [CWE-863: Incorrect Authorization]. Apache has released version 2.0.2 to correct the missing check. Administrators running Apache Answer should upgrade immediately to prevent unauthorized moderation actions.

Critical Impact
Any authenticated user can reject pending edit-revisions in Apache Answer through 2.0.1, undermining content moderation workflows and revision integrity.

Affected Products

Apache Answer versions up to and including 2.0.1
Apache Answer self-hosted deployments exposed to authenticated users
Community Q&A instances relying on edit-revision review workflows

Discovery Timeline

2026-08-05 - CVE-2026-50749 published to NVD
2026-08-05 - Apache publishes advisory on the security mailing list
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-50749

Vulnerability Analysis

Apache Answer allows contributors to propose edits to questions and answers. These edits enter a pending state and require a user with review permission to approve or reject them. The reject action in versions through 2.0.1 does not verify that the caller holds the review permission. Any authenticated account, including newly registered users, can submit reject requests against arbitrary pending revisions. The server processes the rejection and discards the pending edit. Legitimate contributions are lost, and community moderation controls collapse. The issue is a server-side authorization gap, so client-side UI restrictions do not prevent exploitation. See the Apache Security Mailing List Thread for the vendor's technical description.

Root Cause

The reject endpoint for edit-revisions lacks a permission check before executing the state change. The approve counterpart enforces review permission, but the reject handler skips the equivalent guard. This is a classic broken access control pattern in which one code path is protected while a parallel path is not, allowing attackers to reach the same privileged outcome through the unguarded route.

Attack Vector

An attacker registers or uses any existing account on the target Apache Answer instance. The attacker enumerates pending edit-revision identifiers, which are exposed through public revision listings. The attacker then issues authenticated reject requests against each identifier. The application accepts each request and marks the revisions as rejected. No elevated role, token, or moderator privilege is required. Refer to the Openwall OSS Security Update for additional exploitation context.

Detection Methods for CVE-2026-50749

Indicators of Compromise

Unusually high volumes of rejected state transitions on edit-revisions attributed to non-moderator accounts.
Application logs showing reject API calls from user IDs that do not hold the review permission.
Community reports of legitimate edits disappearing without a corresponding moderator action.
Newly registered accounts issuing reject requests shortly after account creation.

Detection Strategies

Audit Apache Answer database records for revisions in the rejected state where the actor lacks moderator roles.
Correlate web server access logs for POST requests to the edit-revision reject endpoint against the reviewer role assignments in the user table.
Baseline normal reject volumes per user and alert on statistical outliers.

Monitoring Recommendations

Forward Apache Answer application and access logs to a centralized logging or SIEM platform for retention and analysis.
Create alerts on repeated calls to revision moderation endpoints from a single authenticated session.
Monitor for account creation followed rapidly by moderation-endpoint activity, which suggests scripted abuse.

How to Mitigate CVE-2026-50749

Immediate Actions Required

Upgrade Apache Answer to version 2.0.2 or later, which introduces the missing authorization check.
Review recent rejected edit-revisions and restore any that were rejected by non-reviewer accounts.
Rotate or review privileged accounts if abuse is suspected.
Restrict registration and require email verification on public instances until patched.

Patch Information

Apache Answer 2.0.2 fixes the missing authorization check on the reject edit-revision operation. Upgrade guidance and release notes are available through the Apache Security Mailing List Thread. Administrators should follow the standard Apache Answer upgrade procedure and validate the deployment after upgrading.

Workarounds

Place Apache Answer behind an authenticated reverse proxy that limits access to trusted users while the patch is applied.
Temporarily disable public account registration to reduce the pool of accounts capable of exploiting the flaw.
Apply web application firewall rules that block the edit-revision reject endpoint for sessions lacking a moderator role claim.

bash

# Example: block reject endpoint for non-moderators at the reverse proxy
location ~ ^/answer/api/v1/revisions/[0-9]+/reject$ {
    if ($http_x_user_role != "moderator") {
        return 403;
    }
    proxy_pass http://answer_backend;
}