Catalogo CVE

CVE-2026-25700

Improper Restriction of Security Token Assignment…

[Catalogo CVE]

Improper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. Previously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

Gravità
High · CVSS 7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.45% · Oct 27, 2026

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
GoRelease not reportedgithub.com/apache/answer2.0.1Fixed[GHSA-4GW2-VG4X-7P29]
GoRelease not reportedgithub.com/apache/incubator-answer2.0.1Fixed[GHSA-4GW2-VG4X-7P29]

Showing 2 fix observations. All 3 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
UnknownRelease not reportedanswer2.0.1UnknownSource applicability is not establishedProvider not reported
GoRelease not reportedgithub.com/apache/answer2.0.1Fixed[GHSA-4GW2-VG4X-7P29]
GoRelease not reportedgithub.com/apache/incubator-answer2.0.1Fixed[GHSA-4GW2-VG4X-7P29]
Original provider fields
{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "answer",
      "fixed_version": "2.0.1",
      "applicability_unknown": true
    },
    {
      "name": "github.com/apache/incubator-answer",
      "ecosystem": "go",
      "provider_url": "https://github.com/advisories/GHSA-4gw2-vg4x-7p29",
      "fixed_version": "2.0.1",
      "provider_source": "github",
      "provider_record_id": "GHSA-4GW2-VG4X-7P29",
      "provider_updated_at": "2026-08-17T21:53:45Z"
    },
    {
      "name": "github.com/apache/answer",
      "ecosystem": "go",
      "provider_url": "https://github.com/advisories/GHSA-4gw2-vg4x-7p29",
      "fixed_version": "2.0.1",
      "provider_source": "github",
      "provider_record_id": "GHSA-4GW2-VG4X-7P29",
      "provider_updated_at": "2026-08-17T21:53:45Z"
    },
    {
      "name": "answer",
      "ranges": [
        {
          "fixed": "2.0.1",
          "introduced": "",
          "last_affected": "",
          "start_excluding": ""
        }
      ],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25700",
      "fixed_version": "2.0.1",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2026-25700",
      "provider_updated_at": "2026-10-25T23:10:00.167"
    }
  ]
}

OpenFactory catalog packages

L’associazione dei pacchetti è in corso.

Osservato:

Riferimenti

[FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)]