Adding a private/unlisted room to a community exposes room metadata in an unauthorised manner.
Impact
Unauthorised users can access the name, avatar, topic and number of members of a room if they know the ID of the room. This vulnerability is limited to homeservers where:
- the vulnerable homeserver is in the room; and
- untrusted users are permitted to create groups (communities).
By default, only homeserver administrators can create groups. However, homeserver administrators can already access this information in the database or using the admin API. As a result, only homeservers where the configuration setting enable_group_creation has been set to true are impacted.
Patches
Server administrators should upgrade to 1.41.1 or higher.
Workarounds
Server administrators can set enable_group_creation to false in their homeserver configuration (this is the default value) to prevent creation of groups by non-administrators.
Administrators that are using a reverse proxy could, with partial loss of group functionality, block the following endpoints:
/_matrix/client/r0/groups/{group_id}/rooms/_matrix/client/unstable/groups/{group_id}/rooms
References
n/a
For more information
If you have any questions or comments about this advisory, e-mail us at security@matrix.org.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | matrix-synapse | < 1.41.1 | 1.41.1 |
References
- https://github.com/matrix-org/synapse/security/advisories/GHSA-jj53-8fmw-f2w2
- https://github.com/matrix-org/synapse/releases/tag/v1.41.1
- https://github.com/matrix-org/synapse/commit/cb35df940a
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXT7ID7DNBRN2TVTETU3SYQHJKEG6PXN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2VHDEPCZ22GJFMZCWA2XZAGPOEV72POF/
- https://nvd.nist.gov/vuln/detail/CVE-2021-39163
- https://github.com/matrix-org/synapse
- https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2021-424.yaml
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2VHDEPCZ22GJFMZCWA2XZAGPOEV72POF
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXT7ID7DNBRN2TVTETU3SYQHJKEG6PXN
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N- Weakness (CWE)
CWE-200- Platform
- Python (PyPI)
- Package
matrix-synapse- Disclosed
- 31.08.2021
- Updated
- 11.10.2026 13:19
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2021-424 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-jj53-8fmw-f2w2 - CC BY 4.0
Vulnerability history: matrix-synapse
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 45
- First → latest
- 03.2019 05.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 21
- Medium 21
- Low 3
Disclosures per year
- 2019: 3
- 2020: 3
- 2021: 12
- 2022: 7
- 2023: 9
- 2024: 7
- 2025: 2
- 2026: 2
-
Adding a private/unlisted room to a community exposes room metadata in an unauthorised manner. this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.