CVE-2026-64945CWE-863broken-access-control

CVE-2026-64945

published October 19, 2026

CVSS
—
EPSS
0%
Percentile
9.9
In the wild
Unconfirmed
What it is

A vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.2.

The question operation controller gates hide/show operations on the wrong permission check result (the unpin permission instead of the hide permission), so in custom role configurations that separate these permissions, a user granted only question.unpin can hide or restore questions without holding question.hide or question.show.

Users are recommended to upgrade to version 2.0.3, which fixes the issue.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00204 · 9.9th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-10-19T14:16Z
References (2)
https://lists.apache.org/thread/3wdqq1vp449bty5ovs02f0894km07wmz · [email protected]http://www.openwall.com/lists/oss-security/2026/10/16/24 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 21 OCT 03:31Z
    EPSS moved — → 0%
    epss
  • 19 OCT 09:30Z
    Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions
    cvelistv5
  • 19 OCT 09:30Z
    Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions
    cvelistv5