Incorrect authorization in Apache Answer - CVE-2026-64945
Published: October 22, 2026
Vulnerability identifier: #VU157269
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64945
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to hide or restore questions without the required permissions.
The vulnerability exists due to incorrect authorization in the Apache Answer question operation controller when handling requests to hide or show questions. A remote user can use the question.unpin permission, which is incorrectly checked for these operations, to hide or restore questions without holding question.hide or question.show.
Affected software
Apache Answer
How to mitigate CVE-2026-64945
Install security update from vendor's website.
Apache Answer - update to 2.0.3