CVE-2026-25700
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
CVE-2026-25700 describes an improper restriction of security token assignment vulnerability in Apache Answer up to version 2.0.0. Previously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired.
Risk Assessment
The organization may be exposed to unauthorized access to administrative APIs, potentially leading to serious security breaches. Users with stale tokens may have access to sensitive data and system functions.
Recommendation
It is recommended to upgrade to version 2.0.1, which fixes the issue. Additionally, consider invalidating all active administrative tokens after changes to the administrator account status.
Other vulnerabilities in Apache Answer
See all- CVE-2026-60053Critical
Apache Answer through version 2.0.1 has insufficient session expiration: administrative API keys remain usable after the owning administrator is demoted or the account is marked inactive, suspended, or deleted, allowing continued access until the keys are explicitly removed.
- CVE-2026-60023High
Apache Answer through version 2.0.1 has a vulnerability exposing sensitive information: deleted or pending answers can be retrieved by unauthorized users through the single-answer read path when the parent question remains visible.
- CVE-2026-50749Medium
Apache Answer through version 2.0.1 has an improper authorization vulnerability: any authenticated user can reject arbitrary pending edit-revisions without review permission due to a missing authorization check on the reject operation.
- CVE-2026-48912Medium
Apache Answer through version 2.0.1 has an improper input validation vulnerability: a missing ownership check in the avatar-cleanup logic allows any authenticated user to delete other users' uploaded files by supplying their file URLs.
- CVE-2026-48911High
Apache Answer through version 2.0.1 has an insufficient verification of data authenticity vulnerability: a missing authorization check in the external-login email binding flow allows unauthenticated attackers to take over arbitrary user accounts by tricking victims into clicking a crafted confirmation link.
- CVE-2026-48834High
Apache Answer through version 2.0.1 has an improper handling of length parameter inconsistency vulnerability: unauthenticated attackers can cause a denial of service via a specially crafted Accept-Language header that triggers excessive CPU consumption during parsing.
- CVE-2026-34905Medium
Apache Answer up to version 2.0.0 did not enforce access restrictions on direct API endpoints for unlisted questions. Authenticated users could discover and view such questions, answers, comments, and revision history.
- CVE-2026-34033Medium
Apache Answer through version 2.0.0 has an XSS vulnerability because user-supplied content is included in notification emails without proper escaping. An authenticated user can inject arbitrary HTML into emails sent to other users.
- CVE-2026-34031Medium
In Apache Answer up to version 2.0.0, there is an unrestricted file upload vulnerability with dangerous type. The server did not sufficiently validate user-supplied image URLs, allowing arbitrary external content to be embedded as profile images.
- CVE-2026-33582Medium
Apache Answer up to version 2.0.0 has an unrestricted file upload vulnerability. A crafted TIFF image can trigger excessive memory allocation during decoding, causing a server crash. Authentication is required.
Original NVD description (English source)
Improper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. Previously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired. Users are recommended to upgrade to version 2.0.1, which fixes the issue.