Live › vulnerability › CVE-2026-64945
Go to dashboardApache Answer's question controller checks the wrong permission for hide and show actions, so a user granted only the unpin permission can hide or restore questions. An attacker with that narrow custom role can change question visibility without holding the hide or show permissions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only deployments that use custom roles separating the unpin permission from the hide and show permissions are exposed, since the flaw only matters when a role holds question.unpin without question.hide or question.show. Installations using only default roles, or those not on the affected versions, can skip it.
No product ranges from the sources yet.
2.0.2 are affected.question.unpin without question.hide or question.show.2.0.3.question.unpin from custom roles that do not also need hide or show rights.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
The question operation controller gates hide/show operations on the wrong permission check result (the unpin permission instead of the hide permission), so in custom role configurations that separate these permissions, a user granted only question.unpin can hide or restore questions without holding question.hide or question.show.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-64945")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.