Skip to main content

Dendrite CVE-2026-63097

| EUVDEUVD-2026-45195 MEDIUM
Incorrect Authorization (CWE-863)
2026-07-17 VulnCheck GHSA-xq7h-2f2w-f2xq
Authentication Bypass Dendrite
5.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.3 MEDIUM

Requires authenticated account (PR:L) over network; low confidentiality impact from room state disclosure only; no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 17, 2026 - 16:19 vuln.today
CVE Published
Jul 17, 2026 - 15:32 cve.org
MEDIUM 5.3

DescriptionCVE.org

Dendrite through 0.13.8 contains an improper access control vulnerability in the syncapi /context endpoint (syncapi/routing/context.go) that allows authenticated local users to access post-leave room state events by exploiting a flawed membership check that evaluates only the RoomExists field while ignoring IsInRoom, HasBeenInRoom, and Membership fields. Attackers who have left a room can call the rooms context API endpoint for a previously permitted event and receive unfiltered current room state that the /messages and /sync endpoints correctly withhold.

AnalysisAI

Post-leave room state disclosure in Dendrite through 0.13.8 allows authenticated local users to retrieve unfiltered current room state from rooms they have previously exited. The syncapi /context endpoint in syncapi/routing/context.go performs an incomplete membership check - evaluating only the RoomExists field while ignoring IsInRoom, HasBeenInRoom, and Membership - effectively treating departed users as current members for this endpoint alone. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain authenticated Dendrite account
Delivery
Join target private room
Exploit
Leave target room
Execution
Retrieve prior event ID from room
Persist
Call /context endpoint with that event ID
Impact
Receive unfiltered current post-leave room state
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must hold a valid authenticated account on the target Dendrite homeserver (CVSS PR:L confirmed). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) accurately reflects the attack profile: network-reachable, low complexity, no attack requirements, but constrained to authenticated users (PR:L) with limited confidentiality impact (VC:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated user who previously joined and departed a private Matrix room hosted on a Dendrite server calls GET /_matrix/client/v3/rooms/{roomId}/context/{eventId} using an event ID they observed before leaving. Because context.go checks only RoomExists rather than the full membership state, the server returns unfiltered current room state - including current membership lists, room topic, and other state events - that the /sync and /messages endpoints would correctly withhold. …
Remediation No vendor-released patched version is confirmed in the available reference data; administrators should monitor the matrix-org/dendrite GitHub repository for a tagged release addressing this issue. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Dendrite

View all
CVE-2026-63095 HIGH POC
7.1 Jul 17

Improper authorization in Dendrite (the Go-based Matrix homeserver) through version 0.13.8 lets any authenticated local

CVE-2026-63096 MEDIUM POC
6.9 Jul 17

Server-side request forgery in Dendrite through 0.13.8 allows unauthenticated remote attackers to weaponize the server a
CVE-2022-36009 HIGH
8.8 Aug 19

gomatrixserverlib is a Go library for matrix protocol federation. Rated high severity (CVSS 8.8), this vulnerability is

CVE-2022-39200 MEDIUM
5.3 Sep 12

Dendrite is a Matrix homeserver written in Go. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploita

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2017-4915 HIGH POC
7.8
CVE-2024-6782 CRITICAL POC
9.8
CVE-2024-38856 CRITICAL POC
9.8
CVE-2023-22518 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2026-63097 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy