CVE-2024-53867 Synapse Matrix has a partial room state leak via Sliding Sync
Attackers can leak partial room state changes to users no longer in a room via Sliding Sync in Synapse Matrix homeservers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-53867?
CVE-2024-53867 is a medium-severity vulnerability in element-hq synapse, published on 3 Dec 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Synapse is an open-source Matrix homeserver. The Sliding Sync feature on Synapse versions between 1.113.0rc1 and 1.120.0 can leak partial room state changes to users no longer in a room. Non-state events, like messages, are unaffected. This vulnerability is fixed in 1.120.1.
Weakness: CWE-497
Which versions are affected by CVE-2024-53867?
3 open source packages ship an affected version, including matrix-synapse.
| Package | Affected | Fixed in |
|---|---|---|
matrix-synapse PyPI | From 1.113.0rc1 | 1.120.1 |
matrix-synapse PyPI | From 1.113.0rc1 | 1.120.1 |
matrix-synapse PyPI | From 1.113.0rc1 | 1.120.1 |
How do I fix CVE-2024-53867?
Upgrade matrix-synapse to 1.120.1 or later.
Is CVE-2024-53867 being exploited?
There is no known exploitation of CVE-2024-53867 in the wild and no public exploit code.
Sources
Also known as GHSA-56w4-5538-8v8h, PYSEC-2026-1610.