CVE-2022-21691: Improper Access Control in Onionshare
Summary
CVE-2022-21691: Improper Access Control in Onionshare. Affects onionshare-cli versions >= 2.3, < 2.5. Fixed in 2.5. How to fix ↓
Also tracked for
- onionshare · Debian:12
The same CVE-2022-21691 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Onionshare is an open-source tool that allows users to securely and anonymously share files over the Tor network. It provides a simple way to create a temporary website on your own computer that can be accessed by others through the Tor browser. Onionshare is widely used by journalists, activists, and individuals who require secure file sharing. However, a vulnerability has been discovered in Onionshare that could potentially allow an attacker to spoof their leave event in a chatroom, tricking other participants into believing they have left the chat.
Vulnerability Detail
The vulnerability, identified as OTF-004, is categorized as an Improper Access Control issue. It allows an adversary with access to the chat environment to spoof their leave event while still persisting in the chat. By doing so, the attacker can continue to access all sent messages and even write new messages using another vulnerability, OTF-003. This can lead to the compromise of sensitive information and the potential for unauthorized activity within the chatroom.
How To Fix
Latest published version: 2.7.0 as of 22 Oct 2026
pip install --upgrade "onionshare-cli==2.7.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.5
This is the first release that contains the fix.
pip install --upgrade "onionshare-cli==2.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. It is recommended to apply the official fix or update provided by the Onionshare development team.
Conclusion
In conclusion, the Improper Access Control vulnerability in Onionshare can allow an attacker to spoof their leave event in a chatroom, potentially compromising the privacy and security of the chat participants. It is crucial to implement the recommended fix and update to the latest version of Onionshare to mitigate the risks associated with this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for onionshare-cli →
FAQ
Onionshare is an open-source tool that allows secure and anonymous file sharing over the Tor network.
The vulnerability allows an attacker to spoof their leave event in a chatroom, potentially compromising the privacy and security of the chat participants.
To protect yourself, it is recommended to update to the latest version of Onionshare once a fix is available. Additionally, exercise caution when participating in chatrooms and be wary of any suspicious activity.
There are currently no known exploits for this vulnerability. However, it is important to apply the fix as soon as it becomes available to mitigate any potential risks.
For more information about this vulnerability, you can refer to the official advisory provided by the Open Technology Fund's Red Team lab.
Related vulnerabilities
Recent vulnerabilities recorded for onionshare-cli.
