This vulnerability in Apache Answer (CWE-1259) allows previously issued administrative tokens to remain valid despite the suspension, deletion, or deactivation of the corresponding administrator account. As a result, an attacker or unauthorized user holding such a token can continue to access administrative APIs until the token expires. The issue affects all versions prior to 2.0.1, and upgrading to version 2.0.1 addresses the problem by invalidating tokens upon account status changes.

The impact is unauthorized continued administrative access via valid tokens after the associated administrator account is no longer active. This could lead to unauthorized administrative actions until token expiration. There is no indication of active exploitation in the wild.

Users should upgrade Apache Answer to version 2.0.1 or later, where the issue is fixed. No other mitigation or temporary workaround is indicated. Patch status is confirmed by the vendor advisory stating the fix is in version 2.0.1.