CVE-2026-25700

HighCVSS 7.2/10Last modified Jun 19, 2026

Description

Improper Restriction of Security Token Assignment vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.0.

Previously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1259

Affected software

No affected versions have been published.

Timeline

Published
Jun 10, 2026
Last modified
Jun 19, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-257017.0An Insecure Temporary File vulnerability in openSUSE sdbootutil allows local users to pre-create a directory to achieve various effects likeCVE-2026-257029.8A Improper Access Control vulnerability in the kernel of SUSE SUSE Linux Enterprise Server 12 SP5 breaks nftables, causing firewall rules apCVE-2026-257037.3NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authentication and cached data coCVE-2026-257045.8A Privilege Dropping / Lowering Errors/Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in  cosmic-greeter can allow an attacCVE-2026-257058.4A vulnerability has been identified in [Rancher's Extensions](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extensCVE-2026-257067.5Improper neutralization of special elements used in an OS command in yast2-samba-client allows an attacker who controls the content of an AcCVE-2026-257078.8A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers supplCVE-2026-25714.3The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'reviewUserSCVE-2026-257107.0The new upstream added a privileged D-Bus helper called plasmaloginauthhelper, which suffers from multiple issues, e.g.aA compromised plasmaCVE-2026-257117.5The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the CVE-2026-257127.5Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizationCVE-2026-257137.8A heap-based buffer overflow vulnerability exists in the ID3v2 parsing functionality of MediaInfoLib (version(s): 26.01). A specially crafte
CVE-2026-25700: High severity, CVSS 7.2 | Vulnix