https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T14:31:08.842504+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2022-06476 cnvd-2022-06476 2026-10-08T14:31:09.017090+00:00 cnvd-2022-06476 https://cve.radiocsirt.org/vuln/euvd-2026-234501 EUVD-2026-234501 2026-10-08T14:31:09.017131+00:00 EUVD-2026-234501 https://cve.radiocsirt.org/vuln/fkie_cve-2022-21695 fkie_cve-2022-21695 2026-10-08T14:31:09.017146+00:00

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions authenticated users (or unauthenticated in public mode) can send messages without being visible in the list of chat participants. This issue has been resolved in version 2.5.

 https://cve.radiocsirt.org/vuln/ghsa-99p8-9p2c-49j4 GHSA-99p8-9p2c-49j4 — Improper Access Control in Onionshare 2026-10-08T14:31:09.017179+00:00

Affected: PyPI: onionshare-cli

Between September 26, 2021 and October 8, 2021, [Radically Open Security](https://www.radicallyopensecurity.com/) conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's [Red Team lab](https://www.opentech.fund/labs/red-team-lab/). This is an issue from that penetration test.

- Vulnerability ID: OTF-009 - Vulnerability type: Improper Access Control - Threat level: Low

## Description:

Authenticated users (or unauthenticated in public mode) can send messages without being visible in the list of chat participants.

## Technical description:

Prerequisites:

- Existing chatroom - Access to the chatroom (Public or known Private Key) - Either a modified frontend client or manual requests from burp/curl

If a user opens the chatroom without emitting the join message he will not be present in session.users[x] list. Therefore there is no listing in the frontend and no chat participant knows another party joined the chat. It is still possible to send messages in the chatroom.

If a user decides to abuse OTF-003 (page 22) he can impersonate messages from existing users; others would not be able to distinguish original and faked messages. This is also a prerequisite for OTF-004 (page 19).

## Impact:

An adversary with access to the chat environment can send messages to the chat without being visible in the list of chat participants.

## Recommendation:

- Allow chat access only after emission of the join event. - Implement proper session handling.

 https://cve.radiocsirt.org/vuln/gsd-2022-21695 gsd-2022-21695 2026-10-08T14:31:09.017222+00:00 gsd-2022-21695 https://cve.radiocsirt.org/vuln/opensuse-su-2024:11983-1 openSUSE-SU-2024:11983-1 — python-onionshare-2.5-1.1 on GA media 2026-10-08T14:31:09.017236+00:00

python-onionshare-2.5-1.1 on GA media

 https://cve.radiocsirt.org/vuln/pysec-2022-46 PYSEC-2022-46 2026-10-08T14:31:09.017258+00:00

Affected: PyPI: onionshare-cli

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions authenticated users (or unauthenticated in public mode) can send messages without being visible in the list of chat participants. This issue has been resolved in version 2.5.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-21695 Withdrawn: UBUNTU-CVE-2022-21695 2026-10-08T14:31:09.017277+00:00

Withdrawn by the publisher.

Affected: Ubuntu:22.04:LTS: onionshare, Ubuntu:24.04:LTS: onionshare, Ubuntu:25.04: onionshare

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions authenticated users (or unauthenticated in public mode) can send messages without being visible in the list of chat participants. This issue has been resolved in version 2.5.