Apache Answer: AdminToken not invalidated after admin deactivation_CVE-2026-25700

7.2 / 10

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

Improper Restriction of Security Token Assignment vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.0.

Previously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired.
Users are recommended to upgrade to version 2.0.1, which fixes the issue.

Basic Information

ID CVE-2026-25700

Source apache

Published Jun 10, 2026 at 14:57

Modified Jun 10, 2026 at 16:14

Affected Product

Vendor Apache Software Foundation

Product Apache Answer

Affected Versions Apache Software Foundation Apache Answer 0

CWE Classification

CWE-1259

References

lists.apache.org /thread/ftw52mlxknjm29vo1mnqovj53z2kh96y

{
    "lastseen": "",
    "description": "Improper Restriction of Security Token Assignment vulnerability in Apache Answer.\n\nThis issue affects Apache Answer: through 2.0.0.\n\nPreviously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired.\nUsers are recommended to upgrade to version 2.0.1, which fixes the issue.",
    "published": "2026-06-10T14:57:00.853Z",
    "modified": "2026-06-10T16:14:45.916Z",
    "type": "cve",
    "title": "Apache Answer: AdminToken not invalidated after admin deactivation",
    "source": "apache",
    "references": "https://lists.apache.org/thread/ftw52mlxknjm29vo1mnqovj53z2kh96y",
    "id": "CVE-2026-25700",
    "bulletinFamily": "",
    "cwe": [
        "CWE-1259"
    ],
    "cvelist": null,
    "sourceData": "Apache Software Foundation Apache Answer 0",
    "sourceHref": "",
    "cvss": {
        "score": 7.2,
        "severity": "HIGH",
        "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "Apache Answer",
    "version": "0",
    "vendor": "Apache Software Foundation",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}