CVE-2022-21695: Improper Access Control in Onionshare
Summary
CVE-2022-21695: Improper Access Control in Onionshare. Affects onionshare-cli versions >= 2.3, < 2.5. Fixed in 2.5. How to fix ↓
Also tracked for
- onionshare · Debian:12
The same CVE-2022-21695 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Onionshare is an open-source tool that allows users to securely and anonymously share files over the Tor network. It provides a simple and user-friendly interface for creating temporary onion services and sharing files through them. Onionshare is written in Python and is available as a command-line tool. It is widely used by individuals and organizations that require secure and private file sharing capabilities.
Vulnerability Detail
The vulnerability identified as CVE-2022-21695 in Onionshare version 2.4 is an instance of improper access control. Authenticated users or unauthenticated users in public mode can send messages in a chatroom without being visible in the list of chat participants. This means that an adversary with access to the chat environment can send messages without being detected by other participants. Additionally, an attacker can impersonate messages from existing users, making it difficult for others to distinguish between genuine and faked messages. This vulnerability can be exploited by leveraging a modified frontend client or by manually sending requests using tools like Burp or cURL.
How To Fix
Latest published version: 2.7.0 as of 22 Oct 2026
pip install --upgrade "onionshare-cli==2.7.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.5
This is the first release that contains the fix.
pip install --upgrade "onionshare-cli==2.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is recommended to follow the steps mentioned in the 'how_to_fix' section to address the issue.
Conclusion
The vulnerability identified in Onionshare version 2.4 allows users to send messages in a chatroom without being visible in the list of chat participants. This can be exploited to conduct unauthorized communication or impersonate other users. To mitigate the risk, it is recommended to update to a fixed version or apply the recommended fixes mentioned in the 'how_to_fix' section. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for onionshare-cli →
FAQ
The vulnerability allows an adversary to send messages in a chatroom without being visible in the list of chat participants. This can be exploited to conduct unauthorized communication or impersonate other users.
Users of Onionshare version 2.4 are affected by this vulnerability. It is important to update to a fixed version or apply the recommended fixes to mitigate the risk.
There are no known instances of this vulnerability being exploited in the wild. However, it is still important to address the issue to prevent potential misuse.
Yes, this vulnerability can be exploited remotely by an adversary with access to the chat environment.
The severity of this vulnerability is rated as moderate, with a CVSS score of 4.3.
Related vulnerabilities
Recent vulnerabilities recorded for onionshare-cli.
