CVE-2026-60053: Apache Answer: Residual Administrative API Key Access After Role or Account Revocation
Insufficient Session Expiration vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.1.
Administrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspended, or deleted, allowing continued access until the keys were explicitly removed. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Answerto a version that resolves this vulnerability.Fixed in 2.0.2Patch CVE-2026-60053
Event History
Frequently Asked Questions
What is the severity of CVE-2026-60053?
CVE-2026-60053 has a risk score of 55, indicating a moderate severity level.
What is the impact of CVE-2026-60053?
CVE-2026-60053 allows continued access to administrative API keys even after the owning administrator's account is revoked or disabled.
How do I fix CVE-2026-60053?
To fix CVE-2026-60053, ensure proper revocation of administrative API keys when an account is demoted or marked inactive.
Which versions of Apache Answer are affected by CVE-2026-60053?
Apache Answer versions through 2.0.1 are affected by CVE-2026-60053.
What is the nature of the vulnerability in CVE-2026-60053?
CVE-2026-60053 is classified as an Insufficient Session Expiration vulnerability.