CVE-2022-21692: Improper Access Control in Onionshare

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-01-18 · updated 2026-06-17
Weakness: CWE-287

Description

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions anyone with access to the chat environment can write messages disguised as another chat participant.

Affected products

onionshare: before 2.5 — fixed in 2.5

How to fix

Upgrade to a fixed version: onionshare 2.5. Check the vendor advisory for mitigations.

References

https://github.com/onionshare/onionshare/releases/tag/v2.5
https://github.com/onionshare/onionshare/security/advisories/GHSA-gjj5-998g-v36v
https://github.com/onionshare/onionshare/releases/tag/v2.5
https://github.com/onionshare/onionshare/security/advisories/GHSA-gjj5-998g-v36v

Get alerted when CVE-2022-21692 or the next vulnerability affects your stack