Apache Answer 2.0.2 permission check bug in Question Controller
CVE-2026-64945 Published on October 19, 2026
Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions
A vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
The question operation controller gates hide/show operations on the wrong permission check result (the unpin permission instead of the hide permission), so in custom role configurations that separate these permissions, a user granted only question.unpin can hide or restore questions without holding question.hide or question.show.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Weakness Type
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-64945 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-64945
Want to know whenever a new CVE is published for Apache Answer? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache Answer:- Before and including 2.0.2 is affected.