{"id":"CVE-2026-25700","sourceIdentifier":"security@apache.org","published":"2026-06-10T16:16:58.743","lastModified":"2026-10-25T23:10:00.167","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Improper Restriction of Security Token Assignment vulnerability in Apache Answer.\n\nThis issue affects Apache Answer: through 2.0.0.\n\nPreviously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired.\nUsers are recommended to upgrade to version 2.0.1, which fixes the issue."},{"lang":"es","value":"Vulnerabilidad de restricción indebida de asignación de tokens de seguridad en Apache Answer.\n\nEste problema afecta a Apache Answer: hasta la versión 2.0.0.\n\nLos tokens administrativos emitidos previamente no fueron invalidados después de que una cuenta de administrador fuera suspendida, eliminada o desactivada, permitiendo el acceso continuado a las API administrativas hasta que el token expirara.\nSe recomienda a los usuarios actualizar a la versión 2.0.1, que corrige el problema."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Answer","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"2.0.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","baseScore":7.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.2,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-10T16:14:22.010124Z","id":"CVE-2026-25700","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-1259"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*","versionEndExcluding":"2.0.1","matchCriteriaId":"8B9547BB-CB67-4B4D-B33D-4BF889D6E311"}]}]}],"references":[{"url":"https://lists.apache.org/thread/ftw52mlxknjm29vo1mnqovj53z2kh96y","source":"security@apache.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/06/10/10","source":"af854a3a-2127-422b-91ae-364da2661108"}]}