CVE-2026-64945: Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions
A vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
The question operation controller gates hide/show operations on the wrong permission check result (the unpin permission instead of the hide permission), so in custom role configurations that separate these permissions, a user granted only question.unpin can hide or restore questions without holding question.hide or question.show.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Answerto a version that resolves this vulnerability.Fixed in 2.0.3
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Apache Answer deployments through 2.0.2 are affected when they use custom role configurations that grant question.unpin while separating it from question.hide and question.show. The issue is not described as affecting roles where those permissions are not separated.
What access does an attacker need?
An attacker needs an account assigned a role with the question.unpin permission. That permission alone can allow the user to hide or restore questions despite lacking question.hide or question.show.
How can the issue be mitigated before upgrading?
Review custom roles and remove question.unpin from users who should not be able to hide or restore questions, or ensure it is assigned only alongside the intended hide/show privileges. Upgrade Apache Answer to 2.0.3 to apply the fix.