AI and data stack advisories

Severe, 6 weeks1490Projects326

1490 severe, 6 weeks · 326 projects

Apache Software FoundationCVE-2026-64945

Apache Answer: improper authorization

Apache Software Foundation

CVE-2026-64945 · Published Oct 19, 2026 · updated Nov 3, 2026

High7.5
No fix yet
Apache Software Foundation advisory

A vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.2.

The question operation controller gates hide/show operations on the wrong permission check result (the unpin permission instead of the hide permission), so in custom role configurations that separate these permissions, a user granted only question.unpin can hide or restore questions without holding question.hide or question.show.

Users are recommended to upgrade to version 2.0.3, which fixes the issue.

Affected versions

PackageAffectedFixed in
Apache Answer
Product
<= 2.0.2No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Severity from
CISA (its enrichment of the CVE record)
Weakness
CWE-863

More Apache Software Foundation advisories

All Apache Software Foundation
High 8.8Oct 19Apache Camel: unsafe deserializationCVE-2026-88900fixed in 4.18.5 +1Medium 4.8Oct 19Apache Camel: information disclosureCVE-2026-85317fixed in 4.18.5 +1Medium 6.5Oct 19Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2...CVE-2026-85296fixed in 4.18.5 +1Medium 4.8Oct 19Apache Camel: improper input validationCVE-2026-85312fixed in 4.18.5 +1Medium 4.3Oct 19Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache...CVE-2026-85313fixed in 4.18.5 +1Medium 6.5Oct 19Apache Camel: improper input validationCVE-2026-85314fixed in 4.18.5 +1