PT-2026-60790 · Matrix.Org · Dendrite

George Chen · CVE-2026-63097 · Publicado 2026-07-17 · Atualizado 2026-07-17

Mitre

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Dendrite through 0.13.8 contains an improper access control vulnerability in the syncapi /context endpoint (syncapi/routing/context.go) that allows authenticated local users to access post-leave room state events by exploiting a flawed membership check that evaluates only the RoomExists field while ignoring IsInRoom, HasBeenInRoom, and Membership fields. Attackers who have left a room can call the rooms context API endpoint for a previously permitted event and receive unfiltered current room state that the /messages and /sync endpoints correctly withhold.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-63097

Produtos afetados

Dendrite

Referências · 3

• 🔥 https://github.com/geo-chen/oss/blob/main/dendrite.md#finding-3-context-returns-current-room-state-to-non-members-and-left-users-history-visibility-bypass · Exploit
• https://vulncheck.com/advisories/dendrite-syncapi-context-endpoint-post-leave-state-exposure · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-63097 · Nota de Segurança