Time-of-check Time-of-use (TOCTOU) Race Condition in Etherpad - #VU161870
Published: November 8, 2026
Vulnerability identifier: #VU161870
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-367
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to read private pads' chat and full revision histories and inject chat messages and saved revisions.
The vulnerability exists due to a time-of-check time-of-use race in Etherpad's collaboration handlers that lets a concurrent pad connection change the target after authorization. An unauthenticated remote attacker can join an accessible pad and race messages against a connection to an unauthorized pad, causing authorized operations to execute against that pad.
Affected software
Etherpad
Remediation
Install security update from vendor's website.
Etherpad - update to 3.3.16