PYSEC-2026-844
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/matrix-synapse/PYSEC-2026-844.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-844
- Aliases
- Published
- 2026-07-06T08:03:21.080320Z
- Modified
- 2026-07-07T11:46:05.879609167Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- Matrix Synapse Authorization Error
- Details
-
In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no
m.room.power_levelsevent in force. - References
-
- https://nvd.nist.gov/vuln/detail/CVE-2018-12423
- https://github.com/matrix-org/matrix-doc/issues/1304
- https://bugs.debian.org/901549
- https://github.com/matrix-org/synapse
- https://matrix.org/blog/2018/06/14/security-update-synapse-0-31-2
- https://pypi.org/project/matrix-synapse
- https://github.com/advisories/GHSA-ch5v-fhg8-7gv9
Affected packages
PyPI / matrix-synapse
Package
- Name
- matrix-synapse
- View open source insights on deps.dev
- Purl
- pkg:pypi/matrix-synapse