CVE-2026-63097
Medium · 4.3CVSS
4.3
EPSS
0.3%
Published
Jul 17, 2026
CISA due date
—
The record
Dendrite through 0.13.8 contains an improper access control vulnerability in the syncapi /context endpoint (syncapi/routing/context.go) that allows authenticated local users to access post-leave room state events by exploiting a flawed membership check that evaluates only the RoomExists field while ignoring IsInRoom, HasBeenInRoom, and Membership fields. Attackers who have left a room can call the rooms context API endpoint for a previously permitted event and receive unfiltered current room state that the /messages and /sync endpoints correctly withhold.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-63414 Shopify App is a Rails engine for building Shopify applications. CWE-863
- CVE-2026-63338 IXP Manager is a full-stack web application for managing Internet Exchange Points. CWE-863
- CVE-2026-63115 ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. CWE-863
- CVE-2026-58412 Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP… CWE-863
- CVE-2026-55493 HotCRP is conference review software. CWE-863
- CVE-2026-55098 Arc is an open, SQL-native time-series database for telemetry. CWE-863
- CVE-2026-115830 In Secret Server versions earlier than 12.3.1, a user under certain conditions could… CWE-863
- CVE-2026-116238 In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins… CWE-863