CVE-2026-25700

The record

Improper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. Previously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

Affected packages

Related vulnerabilities

• CVE-2026-58429 Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints CWE-1259
• CVE-2026-40264 OpenBao is an open source identity-based secrets management system. CWE-1259