This issue affects Apache Answer: through 2.0.2.
The question operation controller gates hide/show operations on the wrong permission check result (the unpin permission instead of the hide permission), so in custom role configurations that separate these permissions, a user granted only question.unpin can hide or restore questions without holding question.hide or question.show.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
No advisories yet.
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Mon, 19 Oct 2026 11:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Mon, 19 Oct 2026 09:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The question operation controller gates hide/show operations on the wrong permission check result (the unpin permission instead of the hide permission), so in custom role configurations that separate these permissions, a user granted only question.unpin can hide or restore questions without holding question.hide or question.show. Users are recommended to upgrade to version 2.0.3, which fixes the issue. | |
| Title | Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions | |
| Weaknesses | CWE-863 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: apache
Published:
Updated: 2026-10-19T10:13:44.202Z
Reserved: 2026-07-21T04:52:45.735Z
Link: CVE-2026-64945
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-19T10:16:48.280
Modified: 2026-10-19T11:17:18.133
Link: CVE-2026-64945
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-19T11:00:19Z