CVE-2026-64945: Apache Answer lets users with only the unpin permission hide or show questions

The advisory CVE-2026-64945 describes a permission mapping flaw in Apache Answer, a question and answer software. According to the text, the question operations controller authorizes hide and show actions based on the unpin permission check, not the hide permission. In custom role setups that separate these permissions, a user who received only the question.unpin permission can hide or restore questions. The stated severity is low, and the affected versions are all up to 2.0.2. The content was posted to the oss-sec list on October 15, 2026 by a researcher and appears in the feed as an automatic translation; for technical details, fixes and the fixed version, consult the original advisory on the oss-sec list and the official Apache Answer project documentation. Always verify the primary source before acting.