Administrator account loss via unchecked self-status change

Business logic error in Apache Answer before 1.0.6 allows remote authenticated users to suspend or delete their own administrator account. The UpdateUserStatus path accepted a caller-supplied user ID without comparing it with the authenticated administrator ID, so self-targeted status changes proceeded. Administrator access is required; the action can disable or delete that administrator account, affecting account integrity and access.