EUVD-2026-36059
GHSA-4gw2-vg4x-7p29
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Improper Restriction of Security Token Assignment vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.0.
Previously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired. Users are recommended to upgrade to version 2.0.1, which fixes the issue.
Articles & Coverage 1
AnalysisAI
Privilege persistence in Apache Answer through version 2.0.0 allows suspended, deleted, or deactivated administrator accounts to retain access to administrative APIs because previously issued tokens are not invalidated upon account state change. The flaw requires high-privilege access to obtain a token initially and carries a CVSS 7.2 with full confidentiality, integrity, and availability impact; no public exploit identified at time of analysis and SSVC marks exploitation as none.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to possess a previously issued administrative token from Apache Answer 2.0.0 or earlier, obtained while the associated account was in good standing (CVSS PR:H). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed and skew lower than the 7.2 CVSS suggests for most defenders. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An organization off-boards a compromised or departing administrator by suspending their Apache Answer account, assuming this revokes access. The former admin (or anyone who captured their token) continues calling administrative endpoints - modifying site configuration, deleting content, or exfiltrating user data - using the still-valid bearer token until it expires naturally. … |
| Remediation | Vendor-released patch: upgrade to Apache Answer 2.0.1, which the advisory at https://lists.apache.org/thread/ftw52mlxknjm29vo1mnqovj53z2kh96y identifies as the fixed release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Inventory all Apache Answer deployments and versions; audit administrative API logs for activity from deactivated or deleted accounts; escalate any suspicious admin access to incident response. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today