User preference to prevent private discussions not respected in fof/byobu
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation, Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-269 and CWE-863.
Summary
fof/byobu is a private discussions extension for Flarum forum. Affected versions were found to not respect private discussion disablement by users. Users of Byobu should update the extension to version 1.1.7, where this has been patched. Users of Byobu with Flarum 1.0 or 1.1 should upgrade to Flarum 1.2 or later, or evaluate the impact this issue has on your forum's users and choose to disable the extension if needed. There are no workarounds for this issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| FriendsOfFlarum | byobu | 0.3.0-beta.2 to before 1.1.7 | 1.1.7 | Patch available | CNA |
| — | fof/byobu (Packagist) | 0.3.0-beta.2 to before 1.1.7 | 1.1.7 | Patch available | GHSA-6gjm-6wj6-4px5 |
- byobu VendorFriendsOfFlarum Affected 0.3.0-beta.2 to before 1.1.7 Fixed in 1.1.7 Patch available CNA
- fof/byobu (Packagist) Vendor— Affected 0.3.0-beta.2 to before 1.1.7 Fixed in 1.1.7 Patch available GHSA-6gjm-6wj6-4px5
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:friendsofflarum:byobu:*:*:*:*:*:*:*:* | 0.32.0 to before 1.1.7 | Vulnerable | FriendsOfFlarum |
| cpe:2.3:a:friendsofflarum:byobu:0.30.0:beta2:*:*:*:*:*:* | 0.30.0 beta2 | Vulnerable | FriendsOfFlarum |
- cpe:2.3:a:friendsofflarum:byobu:*:*:*:*:*:*:*:* Versions 0.32.0 to before 1.1.7 Vulnerable ·FriendsOfFlarum
- cpe:2.3:a:friendsofflarum:byobu:0.30.0:beta2:*:*:*:*:*:* Versions 0.30.0 beta2 Vulnerable ·FriendsOfFlarum
Remediation
- Fix · CNA byobu (FriendsOfFlarum) Fixed in 1.1.7
- Fix · GHSA-6gjm-6wj6-4px5 fof/byobu (Packagist) Fixed in 1.1.7 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-35921
- 2026-10-03 Alias added: GHSA-6gjm-6wj6-4px5
References
Sources
- CVE-2022-35921 · CVE Program
- CVE-2022-35921 · NVD
- FIRST EPSS
- GHSA-6gjm-6wj6-4px5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences