As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-64945: Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions
Apache Answer through version 2.0.2 has an incorrect permission mapping that allows users with only the unpin permission to hide or restore questions. The vulnerability stems from the question operation controller performing hide/show permission checks against the unpin permission instead of the hide permission, affecting deployments with custom role configurations that separate these permissions.
Why it matters: Administrators using Apache Answer with custom role configurations should review whether users granted only the unpin permission have unintended access to hide or restore questions, and patch to a version after 2.0.2.
- Source published
- First seen by Cybersecurity Tracker