What is the CVSS score of CVE-2026-60053?

CVE-2026-60053 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Apache Answer are affected by CVE-2026-60053?

Apache Answer's privilege controls fail to expire API keys when administrators are demoted, deleted, or suspended, allowing former admins to retain complete API-level control indefinitely.

How to fix or mitigate CVE-2026-60053?

Within 24 hours, audit all API keys in your Answer deployment and identify any issued to accounts that have subsequently been demoted, removed, or marked inactive; immediately revoke these keys. Within 7 days, update Apache Answer to version 2.0.2, which fixes key expiration logic. Within 30 days, complete a full API key rotation across all administrator accounts to ensure no orphaned credentials remain.

Apache Answer CVE-2026-60053

EUVD-2026-53402 CRITICAL

Insufficient Session Expiration (CWE-613)

2026-08-05 apache

GHSA-53x4-p5j7-29q6

Apache Information Disclosure Apache Answer Apache Software Foundation

9.1

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

9.1 LOW

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

6.5 MEDIUM

Exploitation demands a valid admin-issued API key from a formerly privileged account, so PR:H; network-reachable API with no added complexity or interaction yields AV:N/AC:L/UI:N, with high C/I and no availability impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Aug 06, 2026 - 22:31 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 06, 2026 - 22:22 vuln.today

cvss_changed

CVSS changed

Aug 06, 2026 - 22:22 NVD

9.1 (CRITICAL)

Analysis Generated

Aug 05, 2026 - 15:51 vuln.today

DescriptionCVE.org

Insufficient Session Expiration vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.1.

Administrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspended, or deleted, allowing continued access until the keys were explicitly removed. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

AnalysisAI

Privileged API access in Apache Answer through 2.0.1 persists after an administrator loses their authority: keys issued to an admin stay valid even after the account is demoted, marked inactive, suspended, or deleted, so a former administrator retains full API-level control until the keys are manually purged. This CWE-613 (Insufficient Session Expiration) flaw carries a vendor CVSS of 9.1 and is fixed in 2.0.2. There is no public exploit identified at time of analysis and EPSS is low (0.16%), consistent with an insider/privilege-retention issue rather than mass internet exploitation.

Technical ContextAI

Apache Answer is an open-source, self-hosted question-and-answer (Q&A) community/knowledge-base platform (analogous to a StackOverflow-style forum) written in Go. It exposes a REST API that can be driven with long-lived administrative API keys/tokens instead of interactive sessions. The root cause is CWE-613, Insufficient Session Expiration: the application ties key creation to an admin identity but never re-validates that the owning account still holds administrative privileges (or even exists) at the time the key is used. Because authorization is checked only at issuance and not on each request, a state change to the underlying account - demotion, deactivation, suspension, or deletion - does not invalidate the already-minted credential.

RemediationAI

Vendor-released patch: upgrade Apache Answer to version 2.0.2, which corrects the key/session validation so credentials are invalidated when the owning admin is demoted, deactivated, suspended, or deleted. Because upgrading does not retroactively guarantee stale keys are gone, immediately and explicitly revoke/rotate all administrative API keys - especially any that belonged to administrators who have been demoted or offboarded - since the advisory notes keys remained usable 'until the keys were explicitly removed.' If you cannot upgrade at once, the concrete compensating control is manual key lifecycle enforcement: audit every existing admin API key, delete keys tied to non-active or non-admin accounts, and add offboarding procedure steps to revoke keys whenever an admin's role changes (trade-off: this is process-dependent and error-prone, so it is a stopgap, not a fix). Advisory references: https://lists.apache.org/thread/2vkcj3bdvso6cywnklt2vtkc2m4o0b5c and https://seclists.org/oss-sec/2026/q3/449.