Executive brief
Dendrite is a server implementation for the Matrix communication protocol. A security flaw allows any logged-in user to remove the email addresses or phone numbers linked to other users' accounts. An attacker can use this to disable a victim's ability to reset their password and potentially take over the victim's account by re-linking the stolen identifier to their own profile.
Technical details
An Insecure Direct Object Reference (IDOR) exists in the 'POST /_matrix/client/v3/account/3pid/delete' endpoint. While the handler authenticates the caller, it fails to verify that the 'address' and 'medium' parameters provided in the request body actually belong to the authenticated user. An attacker with a low-privileged account can exploit the 'Forget3PID' handler to remove a victim's email or MSISDN binding. By subsequently rebinding that identifier through an identity server, the attacker can hijack the homeserver's password reset flow to achieve full account takeover. The Dendrite repository was archived in November 2024, and no official patch has been released for this version.
Affected products
- matrix-org Dendrite <= 0.13.8
Timeline
- 2024-11-25: other: Upstream repository archived by owner
- 2026-07-17: disclosed: Vulnerability details published by researcher
- 2026-07-17: advisory: NVD and VulnCheck advisories published