A critical authentication flaw in Apache Answer allows revoked administrative API keys to maintain access, creating a significant risk of unauthorized administrative control.

This is an insufficient session expiration vulnerability (CWE-613) where administrative API keys are not invalidated upon account demotion, suspension, or deletion. The flaw is unauthenticated, meaning an attacker in possession of a previously valid key can maintain persistent, unauthorized access to administrative functions.

The ability for revoked credentials to remain active poses a severe risk to organizational data integrity and system security. Given the CVSS score of 9.1, this vulnerability allows for unauthorized administrative access, which could lead to full system compromise, data theft, or malicious configuration changes, potentially resulting in significant operational disruption and loss of trust.

Immediate Action: Upgrade to Apache Answer version 2.0.2 or later to ensure that administrative API keys are properly invalidated upon account status changes.

Proactive Monitoring: Review API usage logs for any unauthorized or unexpected activity originating from administrative keys, particularly those associated with accounts that have been recently modified or removed.

Compensating Controls: If an immediate upgrade is not feasible, manually audit and revoke all existing administrative API keys and enforce a rotation policy until the patch can be applied.

Public Exploit Available: No (exploit_available: false)

This vulnerability represents a high-priority risk due to its potential to bypass standard account lifecycle management. Organizations utilizing Apache Answer should prioritize the transition to version 2.0.2 immediately. Failure to address this flaw leaves the administrative interface exposed to unauthorized access by any party who may have previously obtained a valid API key, regardless of the current status of the associated user account.