---
id: "CVE-2026-64945"
kind: "vulnerability"
aliases: ["CVE-2026-64945"]
title: "Apache Answer: unpin permission lets users hide questions without hide rights"
severity: "low"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-answer", "package", "self-hosted"]
not_affected_if: ["default-config", "upgraded-to-2.0.3"]
published_at: "2026-10-19T10:16:48+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T05:12:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64945", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# Apache Answer: unpin permission lets users hide questions without hide rights

Apache Answer's question controller checks the wrong permission for hide and show actions, so a user granted only the unpin permission can hide or restore questions. An attacker with that narrow custom role can change question visibility without holding the hide or show permissions.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Apache Answer version; releases through `2.0.2` are affected.
- Review custom roles for any that grant `question.unpin` without `question.hide` or `question.show`.

## Fix

- Upgrade Apache Answer to `2.0.3`.
- Until upgraded, remove `question.unpin` from custom roles that do not also need hide or show rights.

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-64945

## From the sources

A vulnerability in Apache Answer.



This issue affects Apache Answer: through 2.0.2.

The question operation controller gates hide/show operations on the wrong permission check result (the unpin permission instead of the hide permission), so in custom role configurations that separate these permissions, a user granted only question.unpin can hide or restore questions without holding question.hide or question.show.


Users are recommended to upgrade to version 2.0.3, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_