Vulnerability in Apache Answer Affects User Permissions

CVE-2026-64945

What is CVE-2026-64945?

A flaw exists in Apache Answer where the question operation controller improperly handles permissions related to hiding and showing questions. This misconfiguration allows a user with only unpin permissions to hide or restore questions, bypassing the necessary permissions for hide and show operations. This vulnerability primarily impacts configurations where custom roles are defined with distinct permissions for unpin, hide, and show operations. Users are strongly advised to upgrade to version 2.0.3 to mitigate this issue and enhance their systems' security.

References