Dendrite EUVD-2026-45192

Requires a valid authenticated account on the target Dendrite homeserver (CVSS PR:L) - any low-privilege local user suffices, no admin rights and no victim interaction (UI:N). The attacker must know the victim's target 3PID value (email address or MSISDN) and its medium to specify in the request. Full account-takeover impact additionally requires the deployment to support 3PID rebinding through an identity server and to use 3PID-based password reset; on homeservers that disable identity-server integration or 3PID password recovery, the attacker can still delete victims' bindings (integrity/denial of that binding) but the reset-hijack chain is broken. Affected versions are Dendrite through 0.13.8.

This is a credible, moderate-to-high priority integrity issue rather than a hypothetical high-CVSS finding. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VI:H, VC:N/VA:N, base 7.1) is internally consistent with the description: network-reachable, low complexity, requires low-privilege authentication (any registered local account), no user interaction, and pure integrity impact - no confidentiality or availability loss on the vulnerable system itself. Publicly available exploit code (VulnCheck advisory plus a detailed write-up) meaningfully raises real-world exploitability. No EPSS score was provided and the CVE is not in CISA KEV, so there is no evidence of active mass exploitation; the practical severity hinges on the second-order account-takeover chain (rebind 3PID → hijack password reset), which requires the target homeserver to actually use 3PID-based password recovery via an identity server. Note the scope/impact narrowing: raw CVSS rates VI:H, but the concrete damage is really a bridge to account takeover of specific targeted users, implying targeted rather than opportunistic abuse.

An attacker registers or uses any ordinary account on a target Dendrite homeserver, then sends a crafted POST to the account/3pid/delete endpoint supplying a victim's known email address and medium 'email'. The server deletes the victim's binding without ownership checks; the attacker rebinds that address to their own control via an identity server and triggers the victim's password reset to take over the account. Public exploit/write-up material lowers the skill needed to reproduce this.