Apache Answer exposes an Improper Input Validation flaw in the avatar‑cleanup functionality that bypasses the expected ownership check. The bug allows any authenticated user to trigger deletion of another user’s uploaded file by supplying that file’s URL in the cleanup request. The attacker must have a valid user session, but once authenticated, they can erase data that belongs to other users, undermining data integrity and potentially disrupting service or user experience. This flaw is categorized under CWE‑639, indicating an improper authorization mechanism.

The vulnerability applies to Apache Answer versions prior to 2.0.2, including the 2.0.1 release shipped by the Apache Software Foundation. Only installations that expose the avatar‑cleanup endpoint and accept arbitrary file URLs are affected.

Exploitation requires a valid authenticated session; no additional privilege is needed. Although EPSS and CVSS scores are not publicly available, the nature of the flaw—unauthorized deletion of user data—implies a high impact. The vulnerability is not listed in the CISA KEV catalog, but because it permits loss of user files, patching should be prioritized immediately.