CVE-2026-60053
Medium
Elevated severity or exploit probability.
CVSS base
9.1
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS — probability of exploitation (30 days)
0.3%
28.5th percentile
CISA KEV
Not listed
Weakness / dates
CWE-613
Published 2026-08-05 · modified 2026-08-07
CVSS breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
| Attack Vector | N | Network |
| Attack Complexity | L | Low |
| Privileges Required | N | None |
| User Interaction | N | None |
| Scope | U | Unchanged |
| Confidentiality | H | High |
| Integrity | H | High |
| Availability | N | None |
Timeline
- 2026-08-05 — Published (NVD)
- 2026-08-07 — Last modified (NVD)
Description
Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Administrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspended, or deleted, allowing continued access until the keys were explicitly removed. Users are recommended to upgrade to version 2.0.2, which fixes the issue.