{"id":"CVE-2022-36009","aliases":["EUVD-2022-6558","GHSA-grvv-h2f9-7v9c","GO-2022-0952"],"status":"published","title":"Incorrect parsing of access level in gomatrixserverlib and dendrite","description":"gomatrixserverlib is a Go library for matrix protocol federation. Dendrite is a Matrix homeserver written in Go, an alternative to Synapse. The power level parsing within gomatrixserverlib was failing to parse the `\"events_default\"` key of the `m.room.power_levels` event, defaulting the event default power level to zero in all cases. Power levels are the matrix terminology for user access level. In rooms where the `\"events_default\"` power level had been changed, this could result in events either being incorrectly authorised or rejected by Dendrite servers. gomatrixserverlib contains a fix as of commit `723fd49` and Dendrite 0.9.3 has been updated accordingly. Matrix rooms where the `\"events_default\"` power level has not been changed from the default of zero are not vulnerable. Users are advised to upgrade. There are no known workarounds for this issue.","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00859,"percentile":0.5872,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2022-08-19T20:35:09Z","modified":"2026-10-28T02:30:33Z","fixes":[{"ecosystem":"Go","package":"github.com/matrix-org/dendrite","fixed_in":["0.9.3"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/matrix-org/gomatrixserverlib","fixed_in":["0.0.0-20220815091947-723fd495dde8"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/matrix-org/dendrite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.3"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/matrix-org/gomatrixserverlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.0-20220815091947-723fd495dde8"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/matrix-org/dendrite","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.9.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/matrix-org/gomatrixserverlib","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20220815091947-723fd495dde8"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/matrix-org/gomatrixserverlib","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20220815091947-723fd495dde8"}]}]}],"products":[{"vendor":"matrix","product":"dendrite"},{"vendor":"matrix","product":"gomatrixserverlib"},{"vendor":"matrix-org","product":"gomatrixserverlib"}],"references":[{"url":"https://github.com/matrix-org/gomatrixserverlib/security/advisories/GHSA-grvv-h2f9-7v9c","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/matrix-org/gomatrixserverlib/commit/723fd495dde835d078b9f2074b6b62c06dea4575","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://matrix.org/docs/guides/moderation/#power-levels","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36009","tags":["advisory"]},{"url":"https://pkg.go.dev/vuln/GO-2022-0952","tags":["web"]},{"url":"https://github.com/advisories/GHSA-grvv-h2f9-7v9c"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36009.json","tags":["advisory"]},{"url":"https://github.com/matrix-org/gomatrixserverlib","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-36009","title":"Incorrect parsing of access level in gomatrixserverlib and dendrite","description":"gomatrixserverlib is a Go library for matrix protocol federation. Dendrite is a Matrix homeserver written in Go, an alternative to Synapse. The power level parsing within gomatrixserverlib was failing to parse the `\"events_default\"` key of the `m.room.power_levels` event, defaulting the event default power level to zero in all cases. Power levels are the matrix terminology for user access level. In rooms where the `\"events_default\"` power level had been changed, this could result in events either being incorrectly authorised or rejected by Dendrite servers. gomatrixserverlib contains a fix as of commit `723fd49` and Dendrite 0.9.3 has been updated accordingly. Matrix rooms where the `\"events_default\"` power level has not been changed from the default of zero are not vulnerable. Users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2022-08-19T20:35:09Z","modified":"2025-04-23T17:48:13.25Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:34:35.615708Z"}],"euvd":[{"id":"EUVD-2022-6558","description":"gomatrixserverlib is a Go library for matrix protocol federation. Dendrite is a Matrix homeserver written in Go, an alternative to Synapse. The power level parsing within gomatrixserverlib was failing to parse the `\"events_default\"` key of the `m.room.power_levels` event, defaulting the event default power level to zero in all cases. Power levels are the matrix terminology for user access level. In rooms where the `\"events_default\"` power level had been changed, this could result in events either being incorrectly authorised or rejected by Dendrite servers. gomatrixserverlib contains a fix as of commit `723fd49` and Dendrite 0.9.3 has been updated accordingly. Matrix rooms where the `\"events_default\"` power level has not been changed from the default of zero are not vulnerable. Users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2022-08-19T20:35:09Z","modified":"2025-04-23T17:48:13Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T20:52:10.363195Z"}],"ghsa":[{"id":"GHSA-grvv-h2f9-7v9c","title":"gomatrixserverlib and Dendrite vulnerable to incorrect parsing of the event default power level in event auth","description":"### Impact\n\nThe power level parsing within gomatrixserverlib was failing to parse the `\"events_default\"` key of the `m.room.power_levels` event, defaulting the event default power level to zero in all cases.\n\nIn rooms where the `\"events_default\"` power level had been changed, this could result in events either being incorrectly authorised or rejected by Dendrite servers.\n\n### Patches\n\ngomatrixserverlib contains a fix as of commit `723fd49` and Dendrite 0.9.3 has been updated accordingly.\n\n### Workarounds\n\nMatrix rooms where the `\"events_default\"` power level has not been changed from the default of zero are not vulnerable.\n\n### For more information\n\nIf you have any questions or comments about this advisory, e-mail us at [security@matrix.org](mailto:security@matrix.org).","status":"published","published":"2022-08-30T19:54:34Z","modified":"2023-02-09T21:08:13Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:36:44.81167Z"}],"nvd":[{"id":"CVE-2022-36009","description":"gomatrixserverlib is a Go library for matrix protocol federation. Dendrite is a Matrix homeserver written in Go, an alternative to Synapse. The power level parsing within gomatrixserverlib was failing to parse the `\"events_default\"` key of the `m.room.power_levels` event, defaulting the event default power level to zero in all cases. Power levels are the matrix terminology for user access level. In rooms where the `\"events_default\"` power level had been changed, this could result in events either being incorrectly authorised or rejected by Dendrite servers. gomatrixserverlib contains a fix as of commit `723fd49` and Dendrite 0.9.3 has been updated accordingly. Matrix rooms where the `\"events_default\"` power level has not been changed from the default of zero are not vulnerable. Users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2022-08-19T21:15:08.547Z","modified":"2026-06-17T04:52:43.903Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:07:25.242752Z"}],"osv":[{"id":"CVE-2022-36009","title":"Incorrect parsing of access level in gomatrixserverlib and dendrite","description":"gomatrixserverlib is a Go library for matrix protocol federation. Dendrite is a Matrix homeserver written in Go, an alternative to Synapse. The power level parsing within gomatrixserverlib was failing to parse the `\"events_default\"` key of the `m.room.power_levels` event, defaulting the event default power level to zero in all cases. Power levels are the matrix terminology for user access level. In rooms where the `\"events_default\"` power level had been changed, this could result in events either being incorrectly authorised or rejected by Dendrite servers. gomatrixserverlib contains a fix as of commit `723fd49` and Dendrite 0.9.3 has been updated accordingly. Matrix rooms where the `\"events_default\"` power level has not been changed from the default of zero are not vulnerable. Users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2022-08-19T20:35:09Z","modified":"2026-10-28T02:30:33.315580553Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:44:26.195407Z"},{"id":"GHSA-grvv-h2f9-7v9c","title":"gomatrixserverlib and Dendrite vulnerable to incorrect parsing of the event default power level in event auth","description":"### Impact\n\nThe power level parsing within gomatrixserverlib was failing to parse the `\"events_default\"` key of the `m.room.power_levels` event, defaulting the event default power level to zero in all cases.\n\nIn rooms where the `\"events_default\"` power level had been changed, this could result in events either being incorrectly authorised or rejected by Dendrite servers.\n\n### Patches\n\ngomatrixserverlib contains a fix as of commit `723fd49` and Dendrite 0.9.3 has been updated accordingly.\n\n### Workarounds\n\nMatrix rooms where the `\"events_default\"` power level has not been changed from the default of zero are not vulnerable.\n\n### For more information\n\nIf you have any questions or comments about this advisory, e-mail us at [security@matrix.org](mailto:security@matrix.org).","status":"published","published":"2022-08-30T19:54:34Z","modified":"2023-11-08T04:09:57.073105Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:48.191583Z"},{"id":"GO-2022-0952","title":"Incorrect event parsing in github.com/matrix-org/gomatrixserverlib","description":"Power level parsing does not parse the \"events_default\" key of the m.room.power_levels event, setting the event default power level to zero in all cases. This can cause events to be improperly accepted or rejected in rooms where the event_default power level has been changed.","status":"published","published":"2022-08-22T18:08:50Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}