Executive brief
Dendrite is a server implementation for the Matrix communication protocol. A security flaw allows users who have left a private chat room to continue accessing the room's current state and private information. This could lead to the unauthorized exposure of sensitive conversation metadata and room settings that should no longer be visible to former members.
Technical details
An improper access control vulnerability exists in the syncapi /context endpoint (syncapi/routing/context.go) of Dendrite. The vulnerability stems from a flawed membership check that only evaluates the RoomExists field while failing to verify IsInRoom, HasBeenInRoom, or Membership status. An authenticated attacker who has previously left a room can call the context API for an event they were originally permitted to see; the server then returns the unfiltered current room state. This bypasses the history visibility restrictions correctly enforced by the /messages and /sync endpoints. The product repository was archived in November 2024, and no official patch is currently noted.
Affected products
- Matrix.org Dendrite <= 0.13.8
Timeline
- 2024-11-25: other: Repository archived by owner
- 2026-07-17: disclosed: Vulnerability published and CVE assigned