CVE-2026-64945
Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions
- State
- Published
- Severity
- Not scored
- Published
- Oct 19, 2026
- Updated
- Oct 19, 2026
- Reserved
- Jul 21, 2026
Description
A vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
The question operation controller gates hide/show operations on the wrong permission check result (the unpin permission instead of the hide permission), so in custom role configurations that separate these permissions, a user granted only question.unpin can hide or restore questions without holding question.hide or question.show.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Scores
The record has no CVSS score.
Weaknesses
- CWE-863 Incorrect Authorization
Affected Products
| Product | Versions |
|---|---|
Apache AnswerApache Software Foundation |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.