Apache Answer CVE-2026-25700

Exploitation requires the attacker to possess a previously issued administrative token from Apache Answer 2.0.0 or earlier, obtained while the associated account was in good standing (CVSS PR:H). The vulnerable behavior is triggered specifically when an administrator account undergoes a state change - suspension, deletion, or deactivation - and the operator expects that change to terminate access; the issue does not arise against accounts that simply log out or whose tokens expire normally. Exploitation is bounded by the original token's natural expiration time (set by the deployment's token TTL configuration) and is limited to administrative API surface, not arbitrary user accounts.

Signals are mixed and skew lower than the 7.2 CVSS suggests for most defenders. CVSS lists AV:N/AC:L/PR:H/UI:N with C:H/I:H/A:H, but PR:H means the attacker must already have administrator credentials and a valid token - meaning this is fundamentally a post-compromise persistence/insider-threat issue, not a remote takeover. SSVC reinforces this: Exploitation=none, Automatable=no, Technical Impact=total - high impact if abused but no automation potential and no observed exploitation. No CISA KEV listing and no public PoC is referenced. The realistic risk is highest in environments that rotate admin staff and rely on account suspension as a primary off-boarding control without forcing token revocation; for those operators, this is a genuine concern despite the modest exploitation signals.

An organization off-boards a compromised or departing administrator by suspending their Apache Answer account, assuming this revokes access. The former admin (or anyone who captured their token) continues calling administrative endpoints - modifying site configuration, deleting content, or exfiltrating user data - using the still-valid bearer token until it expires naturally. No public PoC is referenced in the advisory.