Threats tagged 'ghsa-4242-4jmj-g584'

A vulnerability in Apache Answer versions through 2.0.2 allows users with the question.unpin permission to hide or restore questions without having the question.hide or question.show permissions. This is due to the question operation controller incorrectly gating hide/show operations based on the unpin permission check result instead of the hide permission. The issue is fixed in version 2.0.3.