A flaw in Apache Answer allows an authenticated user to modify non-public content without proper authorization checks. The vulnerability enables the attacker to alter data that should remain restricted, potentially leading to integrity violations, exposure of sensitive information, or policy breaches. The weakness is an access-control bypass that enables unauthorized writes to protected resources.

Apache Answer versions through 2.0.2 are affected. All installations of these or earlier releases that expose non-public content are vulnerable.

The exploit demands only authenticated access to the application, which is a commonly available condition. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 8.1, indicating high severity, but the missing authorization check grants the attacker full write capability over protected data, making the risk severe. Based on the description, the likely attack vector is a web request authenticated with a user account that is not authorized to mutate the specific non-public resource.