CyberRota Analysis
AI-GeneratedThe vulnerability allows authenticated local users to exploit improper access control in the syncapi/context endpoint of Dendrite, enabling them to access post-leave room state events despite having left the room. This flaw arises from a faulty membership check that fails to consider critical fields, potentially exposing sensitive information about the current room state. Organizations using Dendrite, particularly those with a focus on secure messaging or collaboration, should prioritize addressing this vulnerability to prevent unauthorized access to sensitive data.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Dendrite through 0.13.8 contains an improper access control vulnerability in the syncapi /context endpoint (syncapi/routing/context.go) that allows authenticated local users to access post-leave room state events by exploiting a flawed membership check that evaluates only the RoomExists field while ignoring IsInRoom, HasBeenInRoom, and Membership fields. Attackers who have left a room can call the rooms context API endpoint for a previously permitted event and receive unfiltered current room state that the /messages and /sync endpoints correctly withhold.