SB2026072952 - Multiple vulnerabilities in Synapse

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026072952

SB2026072952 - Multiple vulnerabilities in Synapse

Published: July 29, 2026

Security Bulletin ID SB2026072952
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 11
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 45% Low 55%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 11 vulnerabilities.


1) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to access unintended endpoints.

The vulnerability exists due to improper access control in some Synapse endpoints when processing URLs with extraneous trailing path data behind a reverse proxy that normalizes paths for routing. A remote attacker can send a specially crafted request to access unintended endpoints.

This issue can bypass reverse proxy rules and expose sensitive endpoints, but use of those endpoints may still require a valid access token.


2) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to evade external rate-limiting.

The vulnerability exists due to improper input validation in HTTP request path handling when processing crafted request paths with extraneous path segments. A remote attacker can send a specially crafted request to evade external rate-limiting.

The Client-Server API, Federation API, Synapse Admin API, and Key Server API are not affected by this issue.


3) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in multipart/form-data request handling when processing malicious multipart/form-data requests with a varied-case Content-Type header. A remote attacker can send a specially crafted request to cause a denial of service.

The issue can exhaust all available memory, causing the service to become unresponsive or be terminated.


4) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to improper input validation in the MSC4186 Sliding Sync response handling when processing room metadata and user profile data. A remote user can join a room with invalid name, avatar, or profile data to cause a denial of service.

Instances that only have trusted local users and either do not federate or only participate in a closed, trusted federation are not affected.


5) Improper handling of exceptional conditions (CVE-ID: N/A)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a client to act as though it has logged out and destroy its cryptographic state.

The vulnerability exists due to improper error handling in Synapse federation request handling when processing client-issued requests concerning remote users or remote rooms, or messages in rooms moderated by a malicious policy server. A remote attacker can operate a malicious homeserver or policy server that returns 401 unauthorized federation responses to cause a client to act as though it has logged out and destroy its cryptographic state.

Homeservers that do not federate or only participate in a closed, trusted federation are not affected. If recovery mechanisms are unavailable, encrypted message history can be irreversibly lost.


6) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to disclose event IDs from an unjoined room.

The vulnerability exists due to improper access control in the federation /timestamp_to_event endpoint when handling requests for the nearest event to a timestamp. A remote attacker can send a request for a room ID it knows to disclose event IDs from an unjoined room.

Only homeservers participating in federation are affected.


7) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose events from another room.

The vulnerability exists due to improper access control in the federation /get_missing_events endpoint when handling requests for missing events. A remote user can send a crafted request referencing events outside the specified room to disclose events from another room.

Exploitation requires the malicious homeserver to be joined to some room on the victim homeserver.


8) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in user-configured push rules when processing or loading push rules. A remote user can create an unbounded number of push rules with an unbounded total size to cause a denial of service.

Homeservers that trust all their local users are not affected.


9) Insufficient verification of data authenticity (CVE-ID: N/A)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to spoof the origin of to-device messages.

The vulnerability exists due to improper origin validation in to-device message handling when processing federation messages from remote homeservers. A remote attacker can send a specially crafted to-device message with a spoofed sender field to spoof the origin of to-device messages.

Homeservers that do not federate or only participate in a closed, trusted federation are not affected.


10) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose authorization events from another room.

The vulnerability exists due to improper access control in the federation /event_auth endpoint when handling requests for event authorization data by event ID. A remote user can send a specially crafted federation request to disclose authorization events from another room.

Exploitation requires the malicious homeserver to be joined to some room on the victim homeserver.


11) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to change the destination of room aliases.

The vulnerability exists due to improper access control in room alias handling when participating in federated rooms. A remote user can cause a room alias to be redirected to a different room to change the destination of room aliases.

Homeservers that do not federate or only participate in a closed, trusted federation are not affected. Exploitation requires a malicious federated homeserver and either conspiring local authenticated users or a local user being tricked into joining a malicious federated room.


Remediation

Install update from vendor's website.

References