CVE-2026-25700

Improper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. Previously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/ftw52mlxknjm29vo1mnqovj53z2kh96y	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/06/10/10

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de restricción indebida de asignación de tokens de seguridad en Apache Answer. Este problema afecta a Apache Answer: hasta la versión 2.0.0. Los tokens administrativos emitidos previamente no fueron invalidados después de que una cuenta de administrador fuera suspendida, eliminada o desactivada, permitiendo el acceso continuado a las API administrativas hasta que el token expirara. Se recomienda a los usuarios actualizar a la versión 2.0.1, que corrige el problema.

Information

Published : 2026-06-10 16:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-25700

Mitre link : CVE-2026-25700

CVE.ORG link : CVE-2026-25700

JSON object : View

Products Affected

apache

answer

CWE

CWE-1259

Improper Restriction of Security Token Assignment

{"id": "CVE-2026-25700", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25700", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-10T16:14:22.010124Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Answer", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.0.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-10T16:16:58.743", "references": [{"url": "https://lists.apache.org/thread/ftw52mlxknjm29vo1mnqovj53z2kh96y", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/06/10/10", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-1259"}]}], "descriptions": [{"lang": "en", "value": "Improper Restriction of Security Token Assignment vulnerability in Apache Answer.\n\nThis issue affects Apache Answer: through 2.0.0.\n\nPreviously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired.\nUsers are recommended to upgrade to version 2.0.1, which fixes the issue."}, {"lang": "es", "value": "Vulnerabilidad de restricci\u00f3n indebida de asignaci\u00f3n de tokens de seguridad en Apache Answer.\n\nEste problema afecta a Apache Answer: hasta la versi\u00f3n 2.0.0.\n\nLos tokens administrativos emitidos previamente no fueron invalidados despu\u00e9s de que una cuenta de administrador fuera suspendida, eliminada o desactivada, permitiendo el acceso continuado a las API administrativas hasta que el token expirara.\nSe recomienda a los usuarios actualizar a la versi\u00f3n 2.0.1, que corrige el problema."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8B9547BB-CB67-4B4D-B33D-4BF889D6E311", "versionEndExcluding": "2.0.1"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}