CVE-2026-64945: Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions

Q: Which deployments are exposed to this issue?

Apache Answer deployments through 2.0.2 are affected when they use custom role configurations that grant question.unpin while separating it from question.hide and question.show. The issue is not described as affecting roles where those permissions are not separated.

Q: What access does an attacker need?

An attacker needs an account assigned a role with the question.unpin permission. That permission alone can allow the user to hide or restore questions despite lacking question.hide or question.show.

Q: How can the issue be mitigated before upgrading?

Review custom roles and remove question.unpin from users who should not be able to hide or restore questions, or ensure it is assigned only alongside the intended hide/show privileges. Upgrade Apache Answer to 2.0.3 to apply the fix.

Published Oct 16, 2026

Updated

A vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.2.

The question operation controller gates hide/show operations on the wrong permission check result (the unpin permission instead of the hide permission), so in custom role configurations that separate these permissions, a user granted only question.unpin can hide or restore questions without holding question.hide or question.show.

Users are recommended to upgrade to version 2.0.3, which fixes the issue.

Affected Software

1 affected component

Apache Answer<=2.0.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Answer to a version that resolves this vulnerability.
Fixed in 2.0.3

Event History

Oct 19, 2026

CVE Published

via MITRE·09:30 AM

Data Sourced

via MITRE·09:30 AM

DescriptionWeakness

Data Sourced

via NVD·10:16 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache Answer deployments through 2.0.2 are affected when they use custom role configurations that grant question.unpin while separating it from question.hide and question.show. The issue is not described as affecting roles where those permissions are not separated.

What access does an attacker need?

An attacker needs an account assigned a role with the question.unpin permission. That permission alone can allow the user to hide or restore questions despite lacking question.hide or question.show.

How can the issue be mitigated before upgrading?

Review custom roles and remove question.unpin from users who should not be able to hide or restore questions, or ensure it is assigned only alongside the intended hide/show privileges. Upgrade Apache Answer to 2.0.3 to apply the fix.

CVE-2026-64945: Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need?

How can the issue be mitigated before upgrading?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need?

How can the issue be mitigated before upgrading?