CVE-2026-63097 Details

An improper access control vulnerability has been identified in the Dendrite Matrix server implementation, specifically in versions through 0.13.8. The issue resides within the SyncAPI context endpoint, where flawed membership checks allow authenticated local users to access room state events that occur after they have left a private room. This vulnerability exploits a membership verification flaw that only considers whether a room exists, disregarding actual membership status. As a result, users can retrieve unfiltered current room state information, including post-leave events, which should be restricted according to the application's history visibility rules.

To address this vulnerability, the membership check in the context endpoint should be revised to properly evaluate whether a user is currently in the room or has recently left. Additionally, the state events returned by the CurrentState function should be filtered according to the room's history visibility rules, ensuring that only appropriate information is disclosed.