CVE-2021-39164
Improper authorisation of /members discloses room membership to non-members
Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with shared history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room. Server administrators should upgrade to 1.41.1 or later in order to receive the patch. One workaround is available. Administrators of servers that use a reverse proxy could, with potentially unacceptable loss of functionality, block the endpoints: /_matrix/client/r0/rooms/{room_id}/members with at query parameter, and /_matrix/client/unstable/rooms/{room_id}/members with at query parameter.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Improper authorisation of /members discloses room membership to non-members
Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with shared history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room. Server administrators should upgrade to 1.41.1 or later in order to receive the patch. One workaround is available. Administrators of servers that use a reverse proxy could, with potentially unacceptable loss of functionality, block the endpoints: /_matrix/client/r0/rooms/{room_id}/members with at query parameter, and /_matrix/client/unstable/rooms/{room_id}/members with at query parameter.
- Record
CVE-2021-39164- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2021-0132
Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with shared history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room. Server administrators should upgrade to 1.41.1 or later in order to receive the patch. One workaround is available. Administrators of servers that use a reverse proxy could, with potentially unacceptable loss of functionality, block the endpoints: /_matrix/client/r0/rooms/{room_id}/members with at query parameter, and /_matrix/client/unstable/rooms/{room_id}/members with at query parameter.
- Record
EUVD-2021-0132- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3x4c-pq33-4w3q
Improper authorisation of members discloses room membership to non-members
Impact
Unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with shared history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room.
Patches
Server administrators should upgrade to 1.41.1 or later.
Workarounds
Administrators of servers that use a reverse proxy could, with potentially unacceptable loss of functionality, block the following endpoints:
/_matrix/client/r0/rooms/{room_id}/memberswithatquery parameter/_matrix/client/unstable/rooms/{room_id}/memberswithatquery parameter
References
n/a
For more information
If you have any questions or comments about this advisory, e-mail us at [email protected].
- Record
GHSA-3x4c-pq33-4w3q- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
NVD
Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with shared history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room. Server administrators should upgrade to 1.41.1 or later in order to receive the patch. One workaround is available. Administrators of servers that use a reverse proxy could, with potentially unacceptable loss of functionality, block the endpoints: /_matrix/client/r0/rooms/{room_id}/members with at query parameter, and /_matrix/client/unstable/rooms/{room_id}/members with at query parameter.
- Record
CVE-2021-39164- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:P/I:N/A:N - Weakness
- CWE-200, CWE-863
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-39164
Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with shared history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room. Server administrators should upgrade to 1.41.1 or later in order to receive the patch. One workaround is available. Administrators of servers that use a reverse proxy could, with potentially unacceptable loss of functionality, block the endpoints: /_matrix/client/r0/rooms/{room_id}/members with at query parameter, and /_matrix/client/unstable/rooms/{room_id}/members with at query parameter.
- Record
ALPINE-CVE-2021-39164- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
OSV
Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with shared history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room. Server administrators should upgrade to 1.41.1 or later in order to receive the patch. One workaround is available. Administrators of servers that use a reverse proxy could, with potentially unacceptable loss of functionality, block the endpoints: /_matrix/client/r0/rooms/{room_id}/members with at query parameter, and /_matrix/client/unstable/rooms/{room_id}/members with at query parameter.
- Record
CVE-2021-39164- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2021-39164
Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with shared history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room. Server administrators should upgrade to 1.41.1 or later in order to receive the patch. One workaround is available. Administrators of servers that use a reverse proxy could, with potentially unacceptable loss of functionality, block the endpoints: /_matrix/client/r0/rooms/{room_id}/members with at query parameter, and /_matrix/client/unstable/rooms/{room_id}/members with at query parameter.
- Record
DEBIAN-CVE-2021-39164- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-3x4c-pq33-4w3q
Improper authorisation of members discloses room membership to non-members
Impact
Unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with shared history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room.
Patches
Server administrators should upgrade to 1.41.1 or later.
Workarounds
Administrators of servers that use a reverse proxy could, with potentially unacceptable loss of functionality, block the following endpoints:
/_matrix/client/r0/rooms/{room_id}/memberswithatquery parameter/_matrix/client/unstable/rooms/{room_id}/memberswithatquery parameter
References
n/a
For more information
If you have any questions or comments about this advisory, e-mail us at [email protected].
- Record
GHSA-3x4c-pq33-4w3q- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-39164
Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with shared history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room. Server administrators should upgrade to 1.41.1 or later in order to receive the patch. One workaround is available. Administrators of servers that use a reverse proxy could, with potentially unacceptable loss of functionality, block the endpoints: /_matrix/client/r0/rooms/{room_id}/members with at query parameter, and /_matrix/client/unstable/rooms/{room_id}/members with at query parameter.
- Record
UBUNTU-CVE-2021-39164- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11041-1 No score
matrix-synapse-1.43.0-1.1 on GA media
These are all security issues fixed in the matrix-synapse-1.43.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11041-1- Updated
- 2026-11-02
OSVPYSEC-2021-425 No score
Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with shared history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room. Server administrators should upgrade to 1.41.1 or later in order to receive the patch. One workaround is available. Administrators of servers that use a reverse proxy could, with potentially unacceptable loss of functionality, block the endpoints: /_matrix/client/r0/rooms/{room_id}/members with at query parameter, and /_matrix/client/unstable/rooms/{room_id}/members with at query parameter.
- Record
PYSEC-2021-425- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
matrix-synapsePyPI |
before 1.41.1 | 1.41.1 |
synapseAlpine:v3.14 |
before 1.41.1-r0 | 1.41.1-r0 |
synapseAlpine:v3.15 |
before 1.41.1-r0 | 1.41.1-r0 |
synapseAlpine:v3.16 |
before 1.41.1-r0 | 1.41.1-r0 |
synapseAlpine:v3.17 |
before 1.41.1-r0 | 1.41.1-r0 |
synapseAlpine:v3.18 |
before 1.41.1-r0 | 1.41.1-r0 |
synapseAlpine:v3.19 |
before 1.41.1-r0 | 1.41.1-r0 |
synapseAlpine:v3.20 |
before 1.41.1-r0 | 1.41.1-r0 |
synapseAlpine:v3.21 |
before 1.41.1-r0 | 1.41.1-r0 |
synapseAlpine:v3.22 |
before 1.41.1-r0 | 1.41.1-r0 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
synapseAlpine:v3.23 |
before 1.41.1-r0 | 1.41.1-r0 |
synapseAlpine:v3.24 |
before 1.41.1-r0 | 1.41.1-r0 |
matrix-synapsePyPI |
before 1.41.1, plus listed versions 0.33.50.33.5.10.33.60.33.6rc10.33.7 Show 45 moreShow less0.33.7rc10.33.7rc20.33.80.33.8rc20.33.90.34.00.34.0.10.34.0rc10.34.0rc20.34.1.10.99.00.99.0rc10.99.0rc20.99.0rc30.99.0rc40.99.10.99.1.10.99.1rc10.99.1rc20.99.20.99.2rc10.99.30.99.3.10.99.3.20.99.3rc10.99.40.99.4rc10.99.50.99.5.10.99.5.20.99.5rc11.0.01.0.0rc11.0.0rc21.0.0rc31.1.01.1.0rc11.1.0rc21.10.01.10.0rc11.10.0rc21.10.0rc31.10.0rc51.10.11.11.0 |
1.41.1 |
matrix-synapseUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 0.19.2+dfsg-60.24.0+dfsg-10.24.0+dfsg-1ubuntu0.1~esm10.24.0+dfsg-1ubuntu0.1~esm4 |
None known |
matrix-synapseUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.3.0-11.4.0-11.5.0-11.5.1-11.6.0-1 Show 12 moreShow less1.6.1-11.7.0-21.7.1-11.7.2-11.7.3-11.8.0-11.9.0-11.9.1-11.10.0-11.10.0-21.11.0-11.11.0-1ubuntu0.1~esm2 |
None known |
matrix-synapseUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1.39.0-11.47.0-21.47.1-11.48.0-11.49.0-1 Show 7 moreShow less1.49.2-11.50.1-11.50.2-11.51.0-11.52.0-11.53.0-11.53.0-1ubuntu0.1~esm2 |
None known |
matrix-synapseopenSUSE:Tumbleweed From an advisory covering 11 CVEs |
before 1.43.0-1.1 | 1.43.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| affected | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-39164 is a low vulnerability (CVSS 3.1) in Element-hq Synapse, published August 31, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.45%, the 73rd percentile. Fixed in matrix-synapse 1.41.1.
References
github.com/matrix-org/synapse/commit/cb35df940a
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PXT7ID7DNBRN2TVTETU3SYQHJKEG6PXN
nvd.nist.gov/vuln/detail/CVE-2021-39164
Show 21 moreShow less
security.alpinelinux.org/vuln/CVE-2021-39164
security-tracker.debian.org/tracker/CVE-2021-39164
ubuntu.com/security/CVE-2021-39164
cve.org/CVERecord?id=CVE-2021-39164
suse.com/security/cve/CVE-2018-12291
Left out here: 147 versions. The JSON record has them.