Vulnerability in Apache Answer
CVE-2026-25700
Improper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. Previously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired. Users are recommended to upgrade to version 2.0.1, which fixes the issue.
EPSS: 0.004 (38.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Answer
- Apache Software Foundation Answer — versions 0
Weakness classification (CWE)
References
- security@apache.org (vendor-advisory, Mailing List, Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2026-25700?
- CVE-2026-25700 is a high-severity vulnerability in Apache Answer, classified under CWE-1259. CVSS score: 7.2/10. Published 2026-06-10.
- How severe is CVE-2026-25700?
- High severity. CVSS v3 base score is 7.2 out of 10.