CVE-2026-64945 Apache Software Foundation CVE debrief

Who should care

Administrators and users of Apache Answer, especially those with custom role configurations, should assess exposure and upgrade to version 2.0.3. This includes reviewing the current role configurations for question.unpin, question.hide, and question.show permissions to prevent unintended actions. Additionally, security teams and vulnerability management teams should prioritize this update to mitigate potential unauthorized actions within their environments

Why it matters

CVE-2026-64945 allows unauthorized users to hide or restore questions in Apache Answer due to incorrect permission checks, requiring upgrade to version 2.0.3.

• Unauthorized users may hide or restore questions without proper permissions
• Custom role configurations may be affected, allowing unintended actions

Technical summary

The question operation controller in Apache Answer incorrectly checks permissions for hiding and showing questions, allowing users with only the unpin permission to perform these actions. This issue arises from a flawed permission check in the controller, which uses the unpin permission instead of the required hide or show permissions. As a result, users with custom roles that include the unpin permission but not the hide or show permissions can inadvertently hide or restore questions. The fix in version 2.0.3 corrects this permission check to ensure proper authorization for these operations.

Defensive priority

Upgrade to version 2.0.3 to fix the issue.

Recommended defensive actions

• Upgrade to version 2.0.3
• Review custom role configurations for question.unpin, question.hide, and question.show permissions
• Monitor for unauthorized question hiding or restoration
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability affects Apache Answer through version 2.0.2 and is fixed in version 2.0.3. Evidence is based on official CVE Program and NIST NVD records. Defenders should verify affected deployments and review custom role configurations for question.unpin, question.hide, and question.show permissions. The issue's scope and severity are confirmed by the CVE record and NVD detail page.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.