CVE-2026-60053

9.1 Critique

Publiée le 05/08/2026 à 18:16 · Modifiée le 07/08/2026 à 15:08 · Analysée par le NVD · Source : security@apache.org

Description

Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Administrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspended, or deleted, allowing continued access until the keys were explicitly removed. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

Traduire en français

Produits concernés

Apache Software Foundation Apache Answer
Apache answer

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.1 Critique	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`

Faiblesses (CWE)

CWE-613

Références

https://lists.apache.org/thread/2vkcj3bdvso6cywnklt2vtkc2m4o0b5c Mailing ListVendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/05/14 Mailing ListThird Party Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories