CVE-2026-63097

Name of the Vulnerable Software and Affected Versions Dendrite versions prior to 0.13.9

Description An improper access control issue exists in the syncapi /context endpoint (syncapi/routing/context.go). Authenticated local users can access room state events that should be restricted after they have left a room. This occurs because the membership check incorrectly evaluates only the RoomExists field, ignoring the IsInRoom, HasBeenInRoom, and Membership fields. Consequently, users who have left a room can use the rooms context API endpoint to retrieve unfiltered current room state, bypassing the restrictions correctly implemented in the /messages and /sync endpoints.

Recommendations Update to a version newer than 0.13.8. Restrict access to the syncapi /context endpoint to minimize the risk of unauthorized data access.