Dashboard / CVE-2026-64945

CVE-2026-64945

HIGH
MEDIUM Priority: 0.01 BB Relevance: 75/100
Published: 2026-10-19 Modified: 2026-11-03 First seen: 2026-11-03 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: None
I: High
A: None

Description

A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The question operation controller gates hide/show operations on the wrong permission check result (the unpin permission instead of the hide permission), so in custom role configurations that separate these permissions, a user granted only question.unpin can hide or restore questions without holding question.hide or question.show. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
Apache Software Foundation Apache Answer 0

References & Advisories (2)

Bug Bounty Relevance

75 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

7.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS — Exploitation Probability

0.18%
Raw Score 0.001760
Percentile 7.2%
Date 2026-11-03

Intelligence Sources

mitre ref →
nvd ref →

External Links