CVE-2026-64945: Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions
Apache Answer through 2.0.2 lets unpin-only users hide or show questions.
Apache disclosed CVE-2026-64945, an incorrect permission mapping in Apache Answer through 2.0.2. The question controller checks the unpin permission rather than the hide permission, so in custom roles that separate those rights a user with only question.unpin can hide or restore questions. Apache rates it low and says 2.0.3 fixes the issue. No exploitation is reported.
- Affects Apache Answer through 2.0.2; fixed in 2.0.3.
- Hide and show checks use the unpin permission instead of hide.
- Users granted only question.unpin can hide or restore questions in split roles.
- Vendor rates the incorrect permission mapping low.
- CVEs
- CVE-2026-64945
- Vendors
- Apache Software Foundation
- Products
- Apache Answer
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-64945 | A vulnerability in Apache Answer | — | — |
From the original article
Posted by Enxin Xie on Oct 15 Severity: low Affected versions: - Apache Answer through 2. 0. 2 Description: A vulnerability in Apache Answer.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.