Executive brief
Apache Answer is a Q&A platform used for community knowledge sharing. When an administrator account is deactivated or deleted, the administrative tokens issued to that account remain valid and continue to grant full administrative access through API calls until they expire naturally. This allows a former administrator (or an attacker who obtained their token) to maintain unauthorized access to sensitive administrative functions including user management, system settings, and data manipulation.
Technical details
This is a token invalidation flaw (CWE-1259: Improper Restriction of Security Token Assignment). When an admin account is suspended, deleted, or deactivated, the system does not revoke or invalidate previously issued authentication tokens for that account. An attacker in possession of a valid token can continue to authenticate to administrative APIs with full privileges until the token reaches its natural expiration time. The vulnerability requires the attacker to already possess a valid admin token, either through prior access or interception. The attack vector is network-based with high privilege requirements (admin token needed). Apache has patched this in version 2.0.1 by implementing token invalidation upon admin account status changes.
Affected products
- Apache Answer through 2.0.0
- Apache incubator-answer through 1.4.2-RC1
Timeline
- 2026-06-10: disclosed: Vulnerability disclosed and assigned CVE-2026-25700
- 2026-05-29: patched: Apache Answer version 2.0.1 released with fix