CVE-2026-63097
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Dendrite through 0.13.8 contains an improper access control vulnerability in the syncapi /context endpoint. It allows authenticated local users to access post-leave room state events by exploiting a flawed membership check.
Risk Assessment
Attackers who have left a room can gain unauthorized access to current room state that should be withheld, compromising data confidentiality.
Recommendation
Update Dendrite to a version above 0.13.8 with fixed access control. Restrict access to the /context endpoint to users currently in the room.
Other vulnerabilities in Dendrite
See all- CVE-2026-63096Medium
Dendrite up to version 0.13.8 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated attackers to cause the server to open outbound TLS connections to arbitrary hosts and ports by supplying an unvalidated serverName parameter to the legacy media download endpoint. Attackers can exploit distinguishable error response classes and leaked internal IP addresses in error messages to perform blind port scanning and enumerate internal network topology.
- CVE-2026-63095Medium
Dendrite through version 0.13.8 contains an improper authorization vulnerability in the Matrix Client-Server API that allows any authenticated local user to delete third-party identifier bindings belonging to other users. Attackers can exploit the unverified Forget3PID handler to remove a victim's email or MSISDN binding and subsequently rebind the address through an identity server to hijack the victim's password reset flow.
Original NVD description (English source)
Dendrite through 0.13.8 contains an improper access control vulnerability in the syncapi /context endpoint (syncapi/routing/context.go) that allows authenticated local users to access post-leave room state events by exploiting a flawed membership check that evaluates only the RoomExists field while ignoring IsInRoom, HasBeenInRoom, and Membership fields. Attackers who have left a room can call the rooms context API endpoint for a previously permitted event and receive unfiltered current room state that the /messages and /sync endpoints correctly withhold.