Apache Answer deployments through version 2.0.2 that use the User Center login integration are affected. The issue concerns sessions created for newly created external users.
The affected user must have a newly created external user session whose external identity is omitted. After the associated central account is suspended or deleted, requests using that session can bypass the central account status checks until the session expires or is revoked.
Revoke affected sessions after suspending or deleting central accounts, since the bypass persists only until the session expires or is revoked. Upgrade to Apache Answer 2.0.3 when possible.
Review whether the deployment runs Apache Answer 2.0.2 or earlier and uses User Center login integration. Investigate active sessions belonging to newly created external users whose central accounts have since been suspended or deleted.