# CVE-2018-6835: Etherpad Lite access restriction bypass in JSONP handling

Source: https://junglewise.ai/threats/cve-2018-6835-etherpad-lite-access-restriction-bypass-in-jsonp-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-05-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2018-6835 · Severity: low · CVSS 3 · Published 2022-05-13

Etherpad Lite is a real-time collaborative text editor. A flaw in JSONP request handling allows remote attackers to bypass access controls and gain unauthorized access to pads and their content. An attacker can exploit this without authentication or special privileges to read or modify collaborative documents.

Technologies: [ep_etherpad-lite (npm)](https://junglewise.ai/threats/technologies/ep-etherpad-lite). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2018-6835 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2018-6835 being exploited in the wild.

**How severe is CVE-2018-6835?** Low severity, with a CVSS score of 3, published 13 May 2022.

**Which products and versions are affected?** Etherpad Lite before 1.6.3; ep_etherpad-lite (npm) SEMVER:introduced=0,fixed=1.6.3.

**Is there a fix for CVE-2018-6835?** Yes. ep_etherpad-lite (npm): upgrade to 1.6.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2018-6835 attacked?** It is attacked over the network.

**Am I affected by CVE-2018-6835?** Check whether you run Etherpad Lite or ep_etherpad-lite (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ep_etherpad-lite (npm): upgrade to 1.6.3 or later

  ```sh
  npm install ep_etherpad-lite@1.6.3
  ```


## Technical details

The vulnerability exists in node/hooks/express/apicalls.js in Etherpad Lite versions before 1.6.3 due to improper sanitization of JSONP callbacks. JSONP is a technique that allows cross-origin requests by wrapping responses in a function call. The vulnerability allows attackers to craft malicious JSONP requests that bypass intended access restrictions on API calls. An attacker can remotely exploit this over the network without requiring authentication or user interaction. The fix, merged in commit 626e58cc, implements better JSONP sanitization. Versions 1.6.3 and later resolve this issue.

## Affected products

- Etherpad Lite before 1.6.3

## Identifiers

- CVE-2018-6835
- GHSA-mvmv-rq2j-97p2

## Timeline

- 2018-02-08: disclosed
- 1.6.3: patched

## References

- [https://github.com/ether/etherpad-lite/commit/626e58cc5af1db3691b41fca7b06c28ea43141b1](https://github.com/ether/etherpad-lite/commit/626e58cc5af1db3691b41fca7b06c28ea43141b1)

## Related threats

- [Etherpad stored XSS in HTML export via unescaped attribute-pool values](https://junglewise.ai/threats/cve-2026-55090-etherpad-stored-xss-in-html-export-via-unescaped-attribute-pool)
- [Etherpad multiple security hardening fixes](https://junglewise.ai/threats/etherpad-multiple-security-hardening-fixes-3a746766)
- [Etherpad replayable token-transfer endpoint with cleartext token exposure](https://junglewise.ai/threats/cve-2026-55088-etherpad-replayable-token-transfer-endpoint-with-cleartext-token)
- [Etherpad predictable temp file paths enable symlink-based file overwrite](https://junglewise.ai/threats/cve-2026-55086-etherpad-predictable-temp-file-paths-enable-symlink-based-file)
- [Etherpad Lite cache-poisoning XSS and open redirect via x-proxy-path header](https://junglewise.ai/threats/cve-2026-55087-etherpad-lite-cache-poisoning-xss-and-open-redirect-via-x-proxy)