{"cve":"CVE-2026-25700","nvd":{"published":"2026-06-10T16:16:58.743","modified":"2026-10-25T23:10:00.167","status":"Modified","description":"Improper Restriction of Security Token Assignment vulnerability in Apache Answer.\n\nThis issue affects Apache Answer: through 2.0.0.\n\nPreviously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired.\nUsers are recommended to upgrade to version 2.0.1, which fixes the issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","score":7.2},"cwes":["CWE-1259"],"references":["https://lists.apache.org/thread/ftw52mlxknjm29vo1mnqovj53z2kh96y","http://www.openwall.com/lists/oss-security/2026/06/10/10"],"products":["apache:answer"],"source":"nvd","synced_at":"2026-10-25T23:44:33.281319194+00:00"},"epss":{"cve":"CVE-2026-25700","score":0.00448,"percentile":0.38696,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-4gw2-vg4x-7p29","url":"https://osv.dev/vulnerability/GHSA-4gw2-vg4x-7p29","summary":"Apache Answer: AdminToken not invalidated after admin deactivation","modified":"2026-08-18T15:10:42.006123725Z","packages":[{"ecosystem":"Go","name":"github.com/apache/incubator-answer","purl":"pkg:golang/github.com/apache/incubator-answer","ranges":["<2.0.1"],"fixed":["2.0.1"]},{"ecosystem":"Go","name":"github.com/apache/answer","purl":"pkg:golang/github.com/apache/answer","ranges":["<2.0.1"],"fixed":["2.0.1"]}]},{"id":"GO-2026-6249","url":"https://osv.dev/vulnerability/GO-2026-6249","summary":"Apache Answer: AdminToken not invalidated after admin deactivation in github.com/apache/answer","modified":"2026-08-18T15:00:27.106265895Z","packages":[{"ecosystem":"Go","name":"github.com/apache/answer","purl":"pkg:golang/github.com/apache/answer","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/apache/incubator-answer","purl":"pkg:golang/github.com/apache/incubator-answer","ranges":["all versions"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}