An administrative token that was issued before an account was suspended, deleted, or deactivated is not invalidated, allowing the token to continue granting access to administrative APIs until it expires. This flaw gives a user who already possesses a valid token the ability to maintain elevated privileges after the administrator account is no longer active, potentially enabling further unauthorized changes or data exfiltration.

Apache Software Foundation’s Apache Answer is affected through version 2.0.0. No other vendors or product lines are listed as impacted.

The vulnerability is not listed in the CISA KEV catalog and EPSS data is not available, so the likelihood of widespread exploitation is unclear. However, the flaw can be leveraged by anyone who already holds a valid administrative token issued before account deactivation, since the token remains usable until its natural expiration. The attack requires no additional privileges beyond the existing token, making it a small‑to‑medium risk for systems still running vulnerable versions.