High severity7.2NVD Advisory· Published Jun 10, 2026· Updated Jun 12, 2026
CVE-2026-25700
CVE-2026-25700
Description
Improper Restriction of Security Token Assignment vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.0.
Previously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired. Users are recommended to upgrade to version 2.0.1, which fixes the issue.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/apache/incubator-answerGo | < 2.0.1 | 2.0.1 |
github.com/apache/answerGo | < 2.0.1 | 2.0.1 |
Affected products
4- ghsa-coords2 versions
< 2.0.1+ 1 more
- (no CPE)range: < 2.0.1
- (no CPE)range: < 2.0.1
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-4gw2-vg4x-7p29ghsaADVISORY
- lists.apache.org/thread/ftw52mlxknjm29vo1mnqovj53z2kh96ynvdMailing ListVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-25700ghsaADVISORY
- www.openwall.com/lists/oss-security/2026/06/10/10ghsaWEB
- github.com/apache/answer/releases/tag/v2.0.1ghsaWEB
News mentions
0No linked articles in our index yet.