CVE-2026-64945
Received Received - Intake

Incorrect Permission Check Leads to Unauthorized Question Hiding in Apache Answer

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Apache Software Foundation

Description
A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The question operation controller gates hide/show operations on the wrong permission check result (the unpin permission instead of the hide permission), so in custom role configurations that separate these permissions, a user granted only question.unpin can hide or restore questions without holding question.hide or question.show. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-64945
EUVD
EUVD-2026-104155

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache Answer 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Apache Answer versions up to 2.0.2. It involves a permission check error in the question operation controller where the system checks the wrong permission (unpin instead of hide) when users try to hide or show questions. This allows users with only the unpin permission to hide or restore questions if custom roles separate these permissions.

Detection Guidance

This vulnerability affects Apache Answer versions through 2.0.2 and involves incorrect permission checks for hiding questions. To detect it, verify your Apache Answer version is 2.0.3 or later. Check custom role configurations to ensure users with question.unpin permission do not have unintended hide/show capabilities.

Impact Analysis

If you use Apache Answer with custom role configurations that separate hide and unpin permissions, an attacker with only the unpin permission could hide or restore questions without proper authorization. This could lead to unauthorized content manipulation or visibility changes on the platform.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a specific permission misconfiguration in Apache Answer. The issue allows unauthorized users to hide or restore questions without proper permissions, which could indirectly impact data integrity or access controls if exploited in a custom role setup.

Mitigation Strategies

Upgrade Apache Answer to version 2.0.3 or later to fix the permission check issue in the question operation controller.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64945. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart