CVE-2026-25700: Apache Answer: AdminToken not invalidated after admin deactivation
Improper Restriction of Security Token Assignment vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.0.
Previously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired. Users are recommended to upgrade to version 2.0.1, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Answerto a version that resolves this vulnerability.Fixed in 2.0.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25700?
The severity of CVE-2026-25700 is rated as 28, indicating a significant risk due to improper invalidation of admin tokens.
How do I fix CVE-2026-25700?
To fix CVE-2026-25700, ensure that all previously issued administrative tokens are invalidated when an administrator account is suspended, deleted, or deactivated.
What systems are affected by CVE-2026-25700?
CVE-2026-25700 affects Apache Answer versions up to and including 2.0.0.
What type of vulnerability is CVE-2026-25700?
CVE-2026-25700 is classified as an Improper Restriction of Security Token Assignment vulnerability.
Why is CVE-2026-25700 considered a security risk?
CVE-2026-25700 poses a security risk because it allows continued access to administrative functions even after deactivation of admin accounts.