Is CVE-2026-25700 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-25700 being exploited in the wild.

How severe is CVE-2026-25700?

High severity, with a CVSS score of 7.2, published 10 June 2026.

Which products and versions are affected?

Apache Software Foundation Answer through 2.0.0; github.com/apache/answer (Go) <= 1.7.1, SEMVER:introduced=0, SEMVER:introduced=0,fixed=2.0.1; github.com/apache/incubator-answer (Go) <= 1.4.2-RC1, SEMVER:introduced=0, SEMVER:introduced=0,fixed=2.0.1.

Is there a fix for CVE-2026-25700?

Yes. github.com/apache/answer (Go): upgrade to 2.0.1 or later; github.com/apache/incubator-answer (Go): upgrade to 2.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-25700 attacked?

It is attacked over the network.

Am I affected by CVE-2026-25700?

Check whether you run Apache Software Foundation Answer, github.com/apache/answer (Go) or github.com/apache/incubator-answer (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25700: Apache Answer improper security token invalidation for administrative accounts

Q: Is there a fix for CVE-2026-25700?

Yes. github.com/apache/answer (Go): upgrade to 2.0.1 or later; github.com/apache/incubator-answer (Go): upgrade to 2.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-25700 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-25700?

Check whether you run Apache Software Foundation Answer, github.com/apache/answer (Go) or github.com/apache/incubator-answer (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25700 · Severity: high · CVSS 7.2 · Published 2026-06-10

Apache Answer is a Q&A platform used for community knowledge sharing. When an administrator account is deactivated or deleted, the administrative tokens issued to that account remain valid and continue to grant full administrative access through API calls until they expire naturally. This allows a former administrator (or an attacker who obtained their token) to maintain unauthorized access to sensitive administrative functions including user management, system settings, and data manipulation.

Technologies: Apache Software Foundation Answer, github.com/apache/answer (Go), github.com/apache/incubator-answer (Go). Vendors: Apache Software Foundation, Go.

Quick answers

Is CVE-2026-25700 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-25700 being exploited in the wild.
How severe is CVE-2026-25700?: High severity, with a CVSS score of 7.2, published 10 June 2026.
Which products and versions are affected?: Apache Software Foundation Answer through 2.0.0; github.com/apache/answer (Go) <= 1.7.1, SEMVER:introduced=0, SEMVER:introduced=0,fixed=2.0.1; github.com/apache/incubator-answer (Go) <= 1.4.2-RC1, SEMVER:introduced=0, SEMVER:introduced=0,fixed=2.0.1.
Is there a fix for CVE-2026-25700?: Yes. github.com/apache/answer (Go): upgrade to 2.0.1 or later; github.com/apache/incubator-answer (Go): upgrade to 2.0.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25700 attacked?: It is attacked over the network.
Am I affected by CVE-2026-25700?: Check whether you run Apache Software Foundation Answer, github.com/apache/answer (Go) or github.com/apache/incubator-answer (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/apache/answer (Go): upgrade to 2.0.1 or later
```
go get github.com/apache/answer@v2.0.1
```
github.com/apache/incubator-answer (Go): upgrade to 2.0.1 or later
```
go get github.com/apache/incubator-answer@v2.0.1
```

Technical details

This is a token invalidation flaw (CWE-1259: Improper Restriction of Security Token Assignment). When an admin account is suspended, deleted, or deactivated, the system does not revoke or invalidate previously issued authentication tokens for that account. An attacker in possession of a valid token can continue to authenticate to administrative APIs with full privileges until the token reaches its natural expiration time. The vulnerability requires the attacker to already possess a valid admin token, either through prior access or interception. The attack vector is network-based with high privilege requirements (admin token needed). Apache has patched this in version 2.0.1 by implementing token invalidation upon admin account status changes.

Affected products

Apache Answer through 2.0.0
Apache incubator-answer through 1.4.2-RC1

Identifiers

CVE-2026-25700
GHSA-4gw2-vg4x-7p29
GO-2026-6249

Timeline

2026-06-10: disclosed: Vulnerability disclosed and assigned CVE-2026-25700
2026-05-29: patched: Apache Answer version 2.0.1 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.