CVE-2018-12423 Matrix Synapse Authorization Error
Unauthenticated users can hijack Matrix rooms lacking power level events, allowing unauthorized control and modification of room state.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-12423?
CVE-2018-12423 is a high-severity missing authorization vulnerability in n/a, published on 14 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no m.room.power_levels event in force.
Which versions are affected by CVE-2018-12423?
3 open source packages ship an affected version, including matrix-synapse. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
matrix-synapse PyPI | All versions | 0.31.2 |
matrix-synapse PyPI | All versions | 0.31.2 |
matrix-synapse PyPI | All versions | 0.31.2 |
Products include Matrix Synapse.
How do I fix CVE-2018-12423?
Upgrade matrix-synapse to 0.31.2 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2018-12423 being exploited?
There is no known exploitation of CVE-2018-12423 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2019-18835 Improper Verification of Cryptographic Signature in matrix-synapse
- CVE-2024-52815 Synapse allows a a malformed invite to break the invitee's `/sync`
- CVE-2024-52805 Synapse allows unsupported content types to lead to memory exhaustion
- CVE-2024-53863 Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders
- CVE-2024-37302 Synapse denial of service through media disk space consumption
Sources
Also known as GHSA-ch5v-fhg8-7gv9, PYSEC-2026-844, UBUNTU-CVE-2018-12423.