In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no m.room.power_levels event in force.
{ "urgency": "not yet assigned" }