GitHub Advisoryadvisory · Go

GHSA-4gw2-vg4x-7p29 Apache Answer: AdminToken not invalidated after admin deactivation

HIGH Published 2026-06-10 Modified 2026-08-17 Official page ↗
Aliases
CVE-2026-25700
Ecosystem
Go
Packages
github.com/apache/incubator-answer, github.com/apache/answer
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1259
Reviewed
2026-08-17

Affected packages

• Go github.com/apache/incubator-answer: < 2.0.1 → fixed in 2.0.1 • Go github.com/apache/answer: < 2.0.1 → fixed in 2.0.1

Description

Improper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. Previously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2026-25700 Improper Restriction of Security Token Assignment vulnerability in Apache Answer. vulnerability

Weakness · CWE (1)

  • CWE-1259 Improper Restriction of Security Token Assignment weakness

References