https://seclists.org/oss-sec/2026/q4/199: CVE-2026-64945: Apache Answer: Incorct permission mapping allows users with only the unpin permission to hide/show questions

Q: Which deployments are exposed to unauthorized question hiding or restoration?

The issue applies to Apache Answer through 2.0.2 only when custom role configurations separate the question.unpin permission from the question.hide and question.show permissions. A user with question.unpin but without question.hide or question.show can perform hide or show operations.

Q: What access does an attacker need?

The attacker must be an authenticated user who has been granted the question.unpin permission. The vulnerability does not state that users without this permission can exploit the issue.

Q: Is the default permission configuration affected?

The issue specifically describes custom role configurations that separate these permissions. The provided information does not establish whether the default role configuration separates them.

Q: What should be done if an affected custom role configuration is in use?

Upgrade Apache Answer to version 2.0.3, which fixes the permission check. Until upgrading, review roles granted question.unpin and remove that permission from users who should not be able to hide or restore questions.

Published Oct 16, 2026

Updated

Affected Software

1 affected component

Apache Answer<=2.0.2

Frequently Asked Questions

Which deployments are exposed to unauthorized question hiding or restoration?

The issue applies to Apache Answer through 2.0.2 only when custom role configurations separate the question.unpin permission from the question.hide and question.show permissions. A user with question.unpin but without question.hide or question.show can perform hide or show operations.

What access does an attacker need?

The attacker must be an authenticated user who has been granted the question.unpin permission. The vulnerability does not state that users without this permission can exploit the issue.

Is the default permission configuration affected?

The issue specifically describes custom role configurations that separate these permissions. The provided information does not establish whether the default role configuration separates them.

What should be done if an affected custom role configuration is in use?

Upgrade Apache Answer to version 2.0.3, which fixes the permission check. Until upgrading, review roles granted question.unpin and remove that permission from users who should not be able to hide or restore questions.