GHSA-56w4-5538-8v8h CVE-2024-53867 PYSEC-2026-1610
Synapse Matrix has a partial room state leak via Sliding Sync
- Severity
- 4.3 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.44%
- Chance of exploitation in the next 30 days. Higher than 38.46% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
- Fix
1.120.1- Upgrade matrix-synapse to this version or later
Description
Impact
The Sliding Sync feature on Synapse versions between 1.113.0rc1 and 1.120.0 can leak partial room state changes to users no longer in a room. Non-state events, like messages, are unaffected.
Patches
Synapse version 1.120.1 fixes the problem.
Workarounds
Disable Sliding Sync.
References
https://github.com/matrix-org/matrix-spec-proposals/pull/4186 https://github.com/element-hq/synapse/blob/d80cd57c54427687afcb48740d99219c88a0fff1/synapse/config/experimental.py#L341-L344
For more information
If you have any questions or comments about this advisory, please email us at security at element.io.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| matrix-synapse | >= 1.113.0rc1, < 1.120.1 |
1.120.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
matrix-synapse PyPI → 1.120.1
- pip
pip install --upgrade "matrix-synapse>=1.120.1"- poetry
poetry add "matrix-synapse>=1.120.1"- uv
uv add "matrix-synapse>=1.120.1"
Severity breakdown
CVSS 3.1 4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Weakness
CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere
The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.
How to prevent it
- Architecture and Design, Implementation: Production applications should never use methods that generate internal details such as stack traces and error messages unless that information is directly committed to a log that is not viewable by the end user. All error message text should be HTML entity encoded before being written to the log file to protect against potential cross-site scripting attacks against the viewer of the logs
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-6qf2-7x63-mm6v Synapse pagination Denial of Service | Low | Also affects matrix-synapse |
| GHSA-8q93-326v-3m7g Synapse CPU starvation (Denial of Service) | Medium | Also affects matrix-synapse |
| GHSA-fh66-fcv5-jjfr Synapse's invalid device keys degrade federation functionality | Medium | Also affects matrix-synapse |
| GHSA-v56r-hwv5-mxg6 Synapse vulnerable to federation denial of service via malformed events | High | Also affects matrix-synapse |
| GHSA-vp6v-whfm-rv3g Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders | Critical | Also affects matrix-synapse |
| GHSA-f3r3-h2mq-hx2h Synapse allows a a malformed invite to break the invitee's `/sync` | Medium | Also affects matrix-synapse |
| GHSA-rfq8-j7rh-8hf2 Synapse allows unsupported content types to lead to memory exhaustion | High | Also affects matrix-synapse |
| GHSA-gjgr-7834-rhxr Synapse's unauthenticated writes to the media repository allow planting of problematic content | Medium | Also affects matrix-synapse |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor