Apache Answer Users Must Patch to Stop Incorrect Question Visibility Controls

Apache Answer installations running version 2.0.2 or earlier require immediate attention due to a logic error in permission handling. The vulnerability, identified as CVE-2026-64945, allows users who possess only the unpin permission to execute hide and show operations on questions. This bypasses the intended hide permission check, enabling unauthorized visibility changes in custom role configurations.

How it unfolded

• On October 15, Enxin Xie posted an advisory to the oss-security mailing list detailing the flaw.
• The report identified that the question operation controller checks for the unpin permission instead of the hide permission.
• This misconfiguration allows users with the unpin right to hide or restore questions, bypassing standard access controls.

Who is affected

Organisations using Apache Answer versions prior to 2.0.3 are affected by this issue. The vulnerability is particularly relevant for deployments that utilise custom role configurations where permissions for unpining and hiding questions are separated. In these setups, a user granted only the question.unpin permission can unexpectedly hide or restore questions. This occurs because the controller gates these operations on the wrong permission check result.

Our take on the response

The advisory clearly identifies the root cause as an incorrect permission mapping in the code logic. By relying on the unpin permission check rather than the specific hide permission, the system fails to enforce the intended access boundaries. This suggests that any deployment with granular role definitions is potentially exposed to this logic flaw until the version is updated.

Who needs to act first

Teams should prioritise updating public-facing or high-traffic Apache Answer instances first to minimise the window of exposure. Before applying updates, verify that current role configurations separate unpin and hide permissions, as these systems are most at risk. Ensure backups of configuration files are current before proceeding with version upgrades. Test the update in a non-production environment to confirm that custom roles function correctly after the patch is applied.

What to do and how to stay safe: Apache Answer

• Check your Apache Answer version immediately to determine if you are running 2.0.2 or an earlier release.
• Review custom role configurations to identify any users who possess the unpin permission but should not have visibility controls.
• Plan an update to version 2.0.3 or later as soon as the vendor provides a stable release.
• Monitor system logs for unusual hide or show operations performed by users with limited permissions.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Apache Answer are affected by CVE-2026-64945?

Apache Answer versions through 2.0.2 are affected by this vulnerability, according to the oss-security advisory.

What can a user with only the unpin permission do with this flaw?

Such a user can hide or restore questions, bypassing the intended hide permission check, as described by Enxin Xie.

When was this vulnerability disclosed?

The advisory was posted to the oss-security mailing list on October 15 by researcher Enxin Xie.