If an authorization script for LuaAuthzProvider were provided in the configuration multiple times, only the arguments of the last specification were used when invoking the script. This could lead to scripts being invoked with unexpected arguments.
Further details are available in the thread of the original report and bug:
This affects Apache HTTP Server versions 2.3 and later (such as what is shipped in Red Hat Enterprise Linux 7), as mod_lua is not available in earlier releases. Note that support for LuaAuthzProvider is experimental.
Created httpd tracking bugs for this issue:
Affects: fedora-all [bug 1174078]
Red Hat does not consider this bug to be a security issue.