CVE-2018-12423: Matrix Synapse Authorization Error Vulnerability
Summary
CVE-2018-12423: Matrix Synapse Authorization Error. Affects matrix-synapse versions < 0.31.2. Fixed in 0.31.2. How to fix ↓
Also tracked for
- matrix-synapse · Debian:13
The same CVE-2018-12423 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Matrix Synapse is an open-source server implementation of the Matrix protocol, which facilitates real-time communication. It allows users to create and manage chat rooms, send messages, and share files across different platforms. The server is designed to be secure and scalable, but vulnerabilities can arise, particularly in its authorization mechanisms, which can lead to unauthorized access to rooms.
Vulnerability Detail
In versions of Matrix Synapse prior to 0.31.2, a critical authorization error exists that allows unauthorized users to hijack chat rooms. This vulnerability arises when there is no 'm.room.power_levels' event in force, which is responsible for defining user permissions within a room. The lack of proper authorization checks can lead to significant security breaches, including unauthorized access to sensitive conversations and data.
How To Fix
Latest published version: 1.163.0 as of 22 Oct 2026
pip install --upgrade "matrix-synapse==1.163.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.31.2
This is the first release that contains the fix.
pip install --upgrade "matrix-synapse==0.31.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to implement strict access controls on chat rooms and ensure that 'm.room.power_levels' events are properly configured to prevent unauthorized access until the package can be updated.
Conclusion
The CVE-2018-12423 vulnerability in Matrix Synapse poses a significant risk by allowing unauthorized users to hijack chat rooms. It is crucial for users to update their installations to version 0.31.2 or later to mitigate this risk. Implementing strict access controls can serve as a temporary measure until the update is applied.
See every vulnerability recorded for matrix-synapse →
FAQ
CVE-2018-12423 is a vulnerability in Matrix Synapse that allows unauthorized users to hijack chat rooms due to a lack of proper authorization checks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The consequences include unauthorized access to chat rooms, potential data leaks, and breaches of user privacy.
Yes, the vulnerability is patched in version 0.31.2 of Matrix Synapse. Users are advised to update to this version or later.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for matrix-synapse.
