HIGH🇵🇱 Wersja polska

CVE-2026-25700

CVSS 7.2v3.1pub. 2026-06-10upd. 2026-06-19

Improper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. Previously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

  • Apache Answer

    APP
    Apache
    < 2.0.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-60053CRITICAL9.1PL ✓same product

Apache Answer: nieważne klucze API nadal aktywne po degradacji konta

CVE-2024-22393CRITICAL9.1PL ✓same product

Apache Answer — atak Pixel Flood przez nieograniczony upload pliku

CVE-2026-60023HIGH7.5PL ✓same product

Apache Answer: nieuprawniony dostęp do usuniętych/oczekujących odpowiedzi

CVE-2026-48834HIGH7.5PL ✓same product

Apache Answer — DoS przez nieprawidłowy nagłówek Accept-Language

CVE-2026-48911HIGH7.5PL ✓same product

Apache Answer: przejęcie konta przez brak weryfikacji w external-login