Apache Answer exposes an Improper Input Validation flaw in the avatar‑cleanup functionality that bypasses the expected ownership check. The bug allows any authenticated user to trigger deletion of another user’s uploaded file by supplying that file’s URL in the cleanup request. The attacker must have a valid user session, but once authenticated, they can erase data that belongs to other users, undermining data integrity and potentially disrupting service or user experience. This flaw is categorized under CWE‑639, indicating an improper authorization mechanism.

The vulnerability applies to Apache Answer versions prior to 2.0.2, including the 2.0.1 release shipped by the Apache Software Foundation. Only installations that expose the avatar‑cleanup endpoint and accept arbitrary file URLs are affected.

Exploitation requires a valid authenticated session; no additional privilege is needed. The CVSS score of 6.5 indicates a moderate severity, and the EPSS score of <1% suggests low exploitation probability. This flaw—unauthorized deletion of user data—poses a significant risk to data integrity. The vulnerability is not listed in the CISA KEV catalog, but because it permits loss of user files, patching should be prioritized immediately.