VulnerabilityModified

CVE-2026-25700

Improper Restriction of Security Token Assignment vulnerability in Apache Answer.

HIGH 7.2EPSS 0.45%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.45%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Improper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. Previously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

CVSS 3.1: 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.45% probability · 38th percentile
CISA KEV: Not listed
Weakness: CWE-1259
Affected: apache/answer
Source: security@apache.org

References

https://lists.apache.org/thread/ftw52mlxknjm29vo1mnqovj53z2kh96yMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/06/10/10

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.