The vulnerability allows administrative API keys to remain valid even after the account owner has been demoted, made inactive, suspended, or deleted. This failure of session expiration means that an attacker who possesses such a key can continue to perform privileged API operations, effectively bypassing account revocation controls and potentially compromising system integrity.

All installations of Apache Answer version 2.0.1 or earlier are affected. Any configuration that issues or relies on administrative API keys for services will be exposed if those keys are not manually revoked when an account’s status changes.

Based on the description, it is inferred that an attacker could exploit a stale key by sending requests to the standard REST API, which would allow privileged operations. The CVSS score is 9.1, indicating a high severity, and the EPSS score is <1%, showing a very low probability of exploitation, yet the impact remains severe because administrators can execute any action reserved for users with elevated privileges. The lack of presence in the CISA KEV catalog does not diminish the risk; exploitation would require possession of a stale key, which is possible if an attacker gains network access to the API endpoint.