CVE-2026-64945

Name of the Vulnerable Software and Affected Versions Apache Answer versions prior to 2.0.3

Description An issue exists in the question operation controller where hide and show operations are gated using the incorrect permission check. Specifically, the system verifies the question.unpin permission instead of the question.hide permission. In custom role configurations where these permissions are separated, a user possessing only the question.unpin permission can hide or restore questions without having the required question.hide or question.show permissions.

Recommendations Upgrade to version 2.0.3.