CVE-2026-25700: Apache Answer: AdminToken not invalidated after admin deactivation

Synopsis

An authentication-bypass vulnerability in Apache Answer allows previously issued admin tokens to remain valid after the administrator account is suspended, deleted, or deactivated. The flaw is reachable over the network and requires a high-privilege (admin-level) token, but because that token is not invalidated on account deactivation, a former administrator retains full API access until the token naturally expires. Successful exploitation gives the attacker full read, write, and availability control over the application. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable API endpoints are exposed over the network, so the attacker must be able to reach the Apache Answer service via HTTP/HTTPS.

• AuthenticationRequired

  A previously issued admin-level token is needed, though the token does not require an active account because it is never invalidated on deactivation.

• Victim interactionNot required

  No victim interaction is needed; the attacker makes direct API calls using the retained token.

• Attack complexityDetail

  The exploit is reliable and condition-free once the attacker holds a previously issued admin token, with no race conditions or environmental factors required.

Blast Radius

• Reads any data accessible to an administrator, including user records, private content, and configuration secrets.
• Modifies or deletes persisted application data, site settings, and user account states.
• Disrupts service availability through administrative API actions such as bulk deletion or configuration corruption.
• Maintains persistent unauthorized access until the orphaned token reaches its natural expiry, potentially spanning hours or days.