CVE-2026-64945
A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The question…
- Risk score
- 51/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 19 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The question operation controller gates hide/show operations on the wrong permission check result (the unpin permission instead of the hide permission), so in custom role configurations that separate these permissions, a user granted on…
- Affected
- See advisory
- Fix
- Upgrade the product to 2.0.3 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.5 high
- Remotely exploitable without logging in
References
Original description
A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The question operation controller gates hide/show operations on the wrong permission check result (the unpin permission instead of the hide permission), so in custom role configurations that separate these permissions, a user granted only question.unpin can hide or restore questions without holding question.hide or question.show. Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Last activity 19 Oct 2026. Patch Forecast updates every hour.