CVE-2022-35921

fof/byobu is a private discussions extension for Flarum forum. Affected versions were found to not respect private discussion disablement by users. Users of Byobu should update the extension to version 1.1.7, where this has been patched. Users of Byobu with Flarum 1.0 or 1.1 should upgrade to Flarum 1.2 or later, or evaluate the impact this issue has on your forum's users and choose to disable the extension if needed. There are no workarounds for this issue.

• CWE-269
• CWE-863

• https://github.com/FriendsOfFlarum/byobu/commit/23dcf93a30f948d30c678a96681f7fdefeba5171Patch, Third Party Advisory
• https://github.com/FriendsOfFlarum/byobu/security/advisories/GHSA-6gjm-6wj6-4px5Third Party Advisory
• https://github.com/FriendsOfFlarum/byobu/commit/23dcf93a30f948d30c678a96681f7fdefeba5171Patch, Third Party Advisory
• https://github.com/FriendsOfFlarum/byobu/security/advisories/GHSA-6gjm-6wj6-4px5Third Party Advisory

Published

Aug 1, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-35916OpenZeppelin Contracts is a library for secure smart contrac…5.3
• CVE-2022-35917Solana Pay is a protocol and set of reference implementation…5.3
• CVE-2022-35918Streamlit is a data oriented application development framewo…6.5
• CVE-2022-35919MinIO is a High Performance Object Storage released under GN…2.7
• CVE-2022-3592A symlink following vulnerability was found in Samba, where …6.5
• CVE-2022-35920Sanic is an opensource python web server/framework. Affected…7.5
• CVE-2022-35922Rust-WebSocket is a WebSocket (RFC6455) library written in R…7.5
• CVE-2022-35923v8n is a javascript validation library. Versions of v8n prio…7.5
• CVE-2022-35924NextAuth.js is a complete open source authentication solutio…9.1
• CVE-2022-35925BookWyrm is a social network for tracking reading. Versions …9.8
• CVE-2022-35926Contiki-NG is an open-source, cross-platform operating syste…7.5
• CVE-2022-35927Contiki-NG is an open-source, cross-platform operating syste…9.8