EUVD-2026-104155
GHSA-4242-4jmj-g584
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as user with custom unpin-only role
-
ExploitInvoke question hide/show operation
-
ExecutionController checks unpin instead of hide permission
-
ImpactQuestion visibility toggled without authorization
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a non-default deployment: an administrator must have created a CUSTOM role configuration that grants question.unpin while separately withholding question.hide and question.show - in stock role setups where these permissions are bundled, the flaw is not reachable. The actor must be a logged-in user assigned that specific role (not an anonymous/remote visitor), and impact is bounded to hiding/restoring questions. These limiting factors - mandatory custom permission configuration plus an authenticated role assignment - substantially narrow real-world exposure despite the web-reachable nature of the endpoint. |
| Impact | This is a genuinely low-priority issue, and the available signals are consistent on that point. No CVSS vector, EPSS score, KEV listing, or POC was provided in any source, so there are no quantitative exploitation signals to weigh - the only severity anchor is the vendor/NVD 'low' rating, which aligns with the nature of the flaw. The vulnerability is a broken access-control / permission-mapping error (the hide/show question operations incorrectly check the question.unpin permission instead of question.hide / question.show), not a memory-corruption or RCE class issue. Impact is limited to unauthorized toggling of question visibility (an integrity/moderation concern), with no confidentiality or availability consequence described. Critically, exploitation only matters in CUSTOM role configurations that deliberately separate unpin from hide/show permissions - default deployments where these permissions travel together are not affected. There are no conflicting signals here; the main gap is the absence of an official CVSS vector, so the 'low' rating cannot be independently validated against a published metric breakdown. Treat this as a routine patch-on-next-cycle item, not an emergency. |
| Exploit ScenarioDerived | On an Apache Answer instance (≤2.0.2) using a custom role that grants question.unpin but intentionally withholds question.hide and question.show, a user holding that role invokes the question hide/restore operation through the web interface or API. Because the controller checks the wrong permission, the action succeeds, letting that user hide or restore questions beyond their intended moderation authority. No public exploit identified at time of analysis; exploitation requires no special tooling once the user has the misconfigured-role access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Incorrect permission mapping in Apache Answer through 2.0.2 allows an authenticated user who holds only the question.unpin permission to hide or restore questions without holding question.hide or question.show. The flaw is only reachable in non-default installations where an administrator has built a custom role that grants question.unpin while separately withholding question.hide and question.show; where Apache Answer ships its stock bundled permissions, the mis-gated check is never satisfied and the issue is not exploitable. No public exploit code has been identified at time of analysis and this is not confirmed actively exploited (not in CISA KEV); the assessed impact is bounded to integrity of question visibility state (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N), and upgrading to 2.0.3 resolves it.
RemediationAI
Vendor-released patch: upgrade Apache Answer to version 2.0.3, which corrects the question operation controller so hide/show requests are gated on the hide/show permissions rather than the unpin permission (see https://answer.apache.org and the oss-security advisory https://seclists.org/oss-sec/2026/q4/199). Until the upgrade can be staged, the most effective compensating control is a permission audit: enumerate custom roles and ensure no role grants question.unpin without also granting the intended question.hide/question.show permissions, or temporarily remove question.unpin from affected roles; the trade-off is that this either widens privileges beyond least-privilege design or strips a legitimate moderation capability from those users. A second option is to disable or restrict access to the question hide/show endpoints at the reverse proxy for untrusted roles, which carries the side effect of blocking legitimate hide/show moderation for those users as well and requires maintaining proxy rules as the API evolves. Because exploitation requires a deliberately separated custom permission set and an authenticated role assignment, deployments running default role bundles need no emergency mitigation and can schedule the 2.0.3 upgrade as routine maintenance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Answer is an open-source Q&A/community platform (Go backend, web UI) whose authorization layer is built around discrete permission flags such as question.unpin, question.hide and question.show that administrators can compose into custom roles. The question operation controller that handles hide/show requests evaluates the wrong permission result: it branches on the outcome of the unpin check rather than the hide/show check, so any principal passing the unpin gate is allowed to execute visibility changes. No CWE identifier was supplied in the source data, but the defect maps to the incorrect-authorization class (e.g. CWE-863 Incorrect Authorization / improper permission assignment), where a resource's operation is gated on an unrelated privilege. The independent assessment records no CPE strings, so affected component identification rests on the vendor statement that all Apache Answer versions through 2.0.2 contain the mis-mapped check; the assessed vector's AC:H and PR:L reflect that exploitation demands a bespoke role configuration plus an authenticated account holding that role, and the S:U/C:N/I:L/A:N scope limits the security consequence to unauthorized modification of question visibility rather than data disclosure, privilege escalation or service disruption.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Web-reachable (AV:N) but needs a non-default custom-role separation (AC:H) and an authenticated low-priv account (PR:L); only question visibility integrity is affected (I:L, C/A:N).
Description PRE-NVD
Threat Intelligence Overview
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB