What is the CVSS score of CVE-2026-25700?

CVE-2026-25700 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Apache Answer are affected by CVE-2026-25700?

Apache Answer deployments running version 2.0.0 or earlier contain a privilege persistence flaw allowing deactivated, suspended, or deleted administrator accounts to maintain full administrative…

How to fix or mitigate CVE-2026-25700?

24 hours: Inventory all Apache Answer deployments and versions; audit administrative API logs for activity from deactivated or deleted accounts; escalate any suspicious admin access to incident response. 7 days: Deploy real-time alerting for administrative API calls from inactive accounts; implement forced token invalidation upon account deactivation (if supported by platform); conduct complete access review of all administrator accounts. 30 days: Establish upgrade timeline to Apache Answer 2.0.1 or later once available; implement additional authentication verification for administrative API endpoints; document and enforce new admin lifecycle procedures requiring forced re-authentication upon any account state change.

Apache Answer CVE-2026-25700

EUVD-2026-36059 HIGH

Improper Restriction of Security Token Assignment (CWE-1259)

2026-06-10 apache

GHSA-4gw2-vg4x-7p29

Information Disclosure Apache Apache Answer

7.2

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (apache) · only source for this CVE.

CVSS VectorVendor: apache

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 18:31 vuln.today

CVSS changed

Jun 10, 2026 - 17:22 NVD

7.2 (HIGH)

CVE Published

Jun 10, 2026 - 14:57 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 10, 2026 - 14:57 nvd

HIGH 7.2

DescriptionCVE.org

Improper Restriction of Security Token Assignment vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.0.

Previously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

Articles & Coverage 1

News 12 New Apache Vulnerabilities - 6 Critical, 6 High Severity Jun 11, 2026

AnalysisAI

Privilege persistence in Apache Answer through version 2.0.0 allows suspended, deleted, or deactivated administrator accounts to retain access to administrative APIs because previously issued tokens are not invalidated upon account state change. The flaw requires high-privilege access to obtain a token initially and carries a CVSS 7.2 with full confidentiality, integrity, and availability impact; no public exploit identified at time of analysis and SSVC marks exploitation as none.

Technical ContextAI

Apache Answer is an open-source Q&A community platform maintained by the Apache Software Foundation, used to build knowledge-sharing sites. The root cause maps to CWE-1259 (Improper Restriction of Security Token Assignment), meaning the application's session/token lifecycle logic does not tie token validity to the underlying account state. When an admin is suspended, deleted, or deactivated, the server-side authorization checks continue to honor the existing bearer/session token until its natural expiration, rather than performing a revocation or state lookup on each privileged API call. CPE data confirms the affected component is cpe:2.3:a:apache_software_foundation:apache_answer.

RemediationAI

Vendor-released patch: upgrade to Apache Answer 2.0.1, which the advisory at https://lists.apache.org/thread/ftw52mlxknjm29vo1mnqovj53z2kh96y identifies as the fixed release. Until the upgrade is applied, operators off-boarding an administrator should not rely solely on account suspension or deletion; rotate the underlying token/session secret (forcing all admin tokens to invalidate), shorten administrative token lifetimes in configuration so the exposure window after suspension is minutes rather than days, and audit admin API access logs for activity by removed accounts. The trade-off of forced rotation is that all current admin sessions must re-authenticate, and shorter token lifetimes increase login friction for legitimate admins.