Description
A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The question operation controller gates hide/show operations on the wrong permission check result (the unpin permission instead of the hide permission), so in custom role configurations that separate these permissions, a user granted only question.unpin can hide or restore questions without holding question.hide or question.show. Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Apache Software Foundation Apache Answer
Default version status: unaffected
0 to ≤ 2.0.2affected
pkg:software-id/apache.org/answer