CVE-2026-25700

7.2 Élevée

Publiée le 10/06/2026 à 18:16 · Modifiée le 19/06/2026 à 08:17 · Modifiée · Source : security@apache.org

Description

Improper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. Previously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

Traduire en français

Produits concernés

Apache Software Foundation Apache Answer
Apache answer

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.2 Élevée	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-1259

Références

https://lists.apache.org/thread/ftw52mlxknjm29vo1mnqovj53z2kh96y Mailing ListVendor Advisory
http://www.openwall.com/lists/oss-security/2026/06/10/10

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories