A flaw in the question operation controller in Apache Answer 2.0.2 causes the hide and show actions to be validated against the wrong permission – the unpin permission instead of the intended hide permission. This allows a user who has only the question.unpin privilege to hide or restore questions that they should not be able to manipulate, effectively giving them unauthorized control over content visibility. The vulnerability does not result in code execution or data disclosure, but it enables a user to subvert moderation and engagement controls within the application.

The issue affects all installations of Apache Answer up to and including version 2.0.2. Users who run these versions, particularly those who have customized role configurations that separate the unpin, hide, and show permissions, are vulnerable. Version 2.0.3 and later contain the fix.

Because the flaw is a permission mis‑check, it can be exploited by any authenticated user who has been granted the unpin permission. The attack does not require special conditions beyond having that permission, so the risk of exploitation is high for sites with permissive role setups. The CVSS score is 7.5, the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog; its impact on moderation authority makes it a serious concern for administrators.