CVE-2023-43796: Synapse vulnerable to leak of remote user device information
Summary
CVE-2023-43796: Synapse vulnerable to leak of remote user device information. Affects matrix-synapse versions < 1.95.1. Fixed in 1.95.1. How to fix ↓
Also tracked for
- matrix-synapse · Debian:13
The same CVE-2023-43796 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Synapse is an open-source Python-based server implementation of the Matrix protocol, which enables decentralized communication. It serves as the reference homeserver for the Matrix network. Synapse allows users to communicate with each other through chat rooms and direct messaging. However, a vulnerability has been discovered in Synapse that allows for the leakage of remote user device information.
Vulnerability Detail
The vulnerability in Synapse allows an attacker to query and obtain cached device information of remote users. This information can be used to enumerate the remote users known to a homeserver. The impact of this vulnerability is the potential exposure of sensitive user data, which can lead to privacy breaches and targeted attacks. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Latest published version: 1.163.0 as of 22 Oct 2026
pip install --upgrade "matrix-synapse==1.163.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.95.1
This is the first release that contains the fix.
pip install --upgrade "matrix-synapse==1.95.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can utilize the federation_domain_whitelist feature to limit federation traffic with a homeserver. By configuring this whitelist, administrators can restrict access to the homeserver and mitigate the risk of remote user device information leakage.
Conclusion
In conclusion, Synapse is vulnerable to the leakage of remote user device information, which can have serious privacy implications. It is crucial for system administrators to upgrade to the latest version of Synapse (1.95.1 or later) to mitigate this vulnerability. Additionally, implementing the federation_domain_whitelist workaround can provide temporary protection. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for matrix-synapse →
FAQ
Synapse is an open-source server implementation of the Matrix protocol, facilitating decentralized communication through chat rooms and direct messaging.
The vulnerability allows for the leakage of remote user device information, which can lead to privacy breaches and targeted attacks.
To fix this vulnerability, upgrade to Synapse version 1.95.1 or later, as it includes patches that address the issue.
Yes, you can utilize the federation_domain_whitelist feature to limit federation traffic with a homeserver and mitigate the risk of information leakage.
The vulnerability has a CVSS score of 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for matrix-synapse.
