CVE-2022-21691: Improper Access Control in Onionshare

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-01-18 · updated 2026-06-17
Weakness: CWE-306

Description

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions chat participants can spoof their channel leave message, tricking others into assuming they left the chatroom.

Affected products

onionshare: before 2.5 — fixed in 2.5

How to fix

Upgrade to a fixed version: onionshare 2.5. Check the vendor advisory for mitigations.

References

https://github.com/onionshare/onionshare/releases/tag/v2.5
https://github.com/onionshare/onionshare/security/advisories/GHSA-w9m4-7w72-r766
https://github.com/onionshare/onionshare/releases/tag/v2.5
https://github.com/onionshare/onionshare/security/advisories/GHSA-w9m4-7w72-r766

Get alerted when CVE-2022-21691 or the next vulnerability affects your stack