CVE-2026-25699

Apache Answer through version 2.0.1 has insufficient session expiration: administrative API keys remain usable after the owning administrator is demoted or the account is marked inactive, suspended, or deleted, allowing continued access until the keys are explicitly removed.

Apache Answer through version 2.0.1 has a vulnerability exposing sensitive information: deleted or pending answers can be retrieved by unauthorized users through the single-answer read path when the parent question remains visible.

Apache Answer through version 2.0.1 has an improper authorization vulnerability: any authenticated user can reject arbitrary pending edit-revisions without review permission due to a missing authorization check on the reject operation.

Apache Answer through version 2.0.1 has an improper input validation vulnerability: a missing ownership check in the avatar-cleanup logic allows any authenticated user to delete other users' uploaded files by supplying their file URLs.

Apache Answer through version 2.0.1 has an insufficient verification of data authenticity vulnerability: a missing authorization check in the external-login email binding flow allows unauthenticated attackers to take over arbitrary user accounts by tricking victims into clicking a crafted confirmation link.

Apache Answer through version 2.0.1 has an improper handling of length parameter inconsistency vulnerability: unauthenticated attackers can cause a denial of service via a specially crafted Accept-Language header that triggers excessive CPU consumption during parsing.

CVE-2026-25700 describes an improper restriction of security token assignment vulnerability in Apache Answer up to version 2.0.0. Previously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired.

Apache Answer up to version 2.0.0 did not enforce access restrictions on direct API endpoints for unlisted questions. Authenticated users could discover and view such questions, answers, comments, and revision history.

Apache Answer through version 2.0.0 has an XSS vulnerability because user-supplied content is included in notification emails without proper escaping. An authenticated user can inject arbitrary HTML into emails sent to other users.

In Apache Answer up to version 2.0.0, there is an unrestricted file upload vulnerability with dangerous type. The server did not sufficiently validate user-supplied image URLs, allowing arbitrary external content to be embedded as profile images.