CVE-2022-35921: fof/byobu is a private discussions extension for Flarum forum

Routine

LOW 3.5UPGRADE

CVE-2022-35921 is a low-severity flaw (CVSS 3.5) affecting byobu. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

fof/byobu is a private discussions extension for Flarum forum. Affected versions were found to not respect private discussion disablement by users. Users of Byobu should update the extension to version 1.1.7, where this has been patched. Users of Byobu with Flarum 1.0 or 1.1 should upgrade to Flarum 1.2 or later, or evaluate the impact this issue has on your forum's users and choose to disable the extension if needed. There are no workarounds for

Why this priority

No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score	3.5 (Low)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	Low
User interaction	Required
EPSS exploit chance	0.5% (top 55%)
CISA exploited list	No
Weakness	CWE-269, CWE-863
Published	2022-08-01
Last modified	2026-06-17

Publisher (CNA): GitHub, Inc. · Vendor: friendsofflarum

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2022-08-01 22:15 UTCPublished CVE record published
2026-06-17 04:52 UTCUpdated Record last modified

friendsofflarum byobu UPGRADE

Affected: >= 0.32.0 and < 1.1.7 · 0.30.0 beta2

Fixed in: 1.1.7

Safe to downgrade to: a release before 0.30.0

1. Check installed version

apt-cache policy byobu || rpm -q byobu || byobu --version

2. UPGRADE to 1.1.7 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade byobu

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade byobu

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 0.30.0 (Debian / Ubuntu)

apt-cache madison byobu sudo apt install byobu=<VERSION_BEFORE_0.30.0> sudo apt-mark hold byobu

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list byobu sudo dnf downgrade byobu-<VERSION_BEFORE_0.30.0> sudo dnf versionlock add byobu

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2022-35921?

byobu: upgrade to 1.1.7. Exact commands for each OS are on this page.

Is CVE-2022-35921 being exploited?

CVE-2022-35921 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2022-35921 affect?

CVE-2022-35921 affects byobu. Severity is low (CVSS 3.5). fof/byobu is a private discussions extension for Flarum forum. Affected versions were found to not respect private discussion disablement by users. Users of Byobu should update the extension to version 1.1.7, where this has been patched. Us

How urgent is CVE-2022-35921?

Priority 23/100. No elevated risk signals yet.

Related CVEs

CVE-2019-7306 MEDIUM 4.3 MITIGATE MITIGATE Byobu Apport hook may disclose sensitive information since it automatically uploads the local user's .screenrc

References

← Back to latest CVEs