CVE-2026-64945

Full vulnerability record from the local CVENow database.

Description

A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The question operation controller gates hide/show operations on the wrong permission check result (the unpin permission instead of the hide permission), so in custom role configurations that separate these permissions, a user granted only question.unpin can hide or restore questions without holding question.hide or question.show. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2026-10-19 10:16:48.280000

Last modified

2026-10-19 20:47:17.723000

View original CVE JSON

{
  "id": "CVE-2026-64945",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-19T10:16:48.280",
  "lastModified": "2026-10-19T20:47:17.723",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\nThe question operation controller gates hide/show operations on the wrong permission check result (the unpin permission instead of the hide permission), so in custom role configurations that separate these permissions, a user granted only question.unpin can hide or restore questions without holding question.hide or question.show.\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Answer",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:software-id/apache.org/answer",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "2.0.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://lists.apache.org/thread/3wdqq1vp449bty5ovs02f0894km07wmz",
      "source": "[email protected]"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/10/16/24",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}