VULNERABILITY INTELLIGENCE

CVE-2026-25700

CVSS score7.2 HIGH
EPSS probability0.45%
CISA KEVNot currently listed
Published2026-06-10
Last modified2026-10-25
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

Improper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. Previously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

Weakness classification

  • security@apache.org: CWE-1259

Primary references