{"id":"CVE-2024-53867","aliases":["ALPINE-CVE-2024-53867","DEBIAN-CVE-2024-53867","EUVD-2024-3430","GHSA-56w4-5538-8v8h","PYSEC-2026-1610","UBUNTU-CVE-2024-53867","openSUSE-SU-2024:14541-1"],"status":"published","title":"Synapse Matrix has a partial room state leak via Sliding Sync","description":"Synapse is an open-source Matrix homeserver. The Sliding Sync feature on Synapse versions between 1.113.0rc1 and 1.120.0 can leak partial room state changes to users no longer in a room. Non-state events, like messages, are unaffected. This vulnerability is fixed in 1.120.1.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00442,"percentile":0.3872,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-497"],"published":"2024-12-03T16:52:01Z","modified":"2026-11-03T06:32:50Z","fixes":[{"ecosystem":"PyPI","package":"matrix-synapse","fixed_in":["1.120.1"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.20","package":"synapse","fixed_in":["1.120.1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"synapse","fixed_in":["1.120.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"synapse","fixed_in":["1.120.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"synapse","fixed_in":["1.120.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"synapse","fixed_in":["1.120.2-r0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"matrix-synapse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.113.0rc1"},{"fixed":"1.120.1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"synapse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.120.1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"synapse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.120.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"synapse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.120.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"synapse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.120.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"synapse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.120.2-r0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"matrix-synapse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.113.0rc1"},{"fixed":"1.120.1"}]}],"versions":["1.113.0","1.113.0rc1","1.114.0","1.114.0rc1","1.114.0rc3","1.115.0","1.115.0rc1","1.115.0rc2","1.116.0","1.116.0rc1","1.116.0rc2","1.117.0","1.117.0rc1","1.118.0","1.118.0rc1","1.119.0","1.119.0rc2","1.120.0","1.120.0rc1"]},{"source":"osv","ecosystem":"PyPI","package":"matrix-synapse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.113.0rc1"},{"fixed":"1.120.1"}]}],"versions":["1.113.0","1.113.0rc1","1.114.0","1.114.0rc1","1.114.0rc3","1.115.0","1.115.0rc1","1.115.0rc2","1.116.0","1.116.0rc1","1.116.0rc2","1.117.0","1.117.0rc1","1.118.0","1.118.0rc1","1.119.0","1.119.0rc2","1.120.0","1.120.0rc1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"matrix-synapse","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.120.2-1.1"}]}],"bundled":6}],"products":[{"vendor":"element-hq","product":"synapse"}],"references":[{"url":"https://github.com/element-hq/synapse/security/advisories/GHSA-56w4-5538-8v8h","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/matrix-org/matrix-spec-proposals/pull/4186","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53867","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-56w4-5538-8v8h","tags":["advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-53867","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53867.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-53867","tags":["advisory"]},{"url":"https://github.com/element-hq/synapse","tags":["package"]},{"url":"https://pypi.org/project/matrix-synapse","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-53867","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-53867","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-37302","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-37303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-52815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53867","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-53867","title":"Synapse Matrix has a partial room state leak via Sliding Sync","description":"Synapse is an open-source Matrix homeserver. The Sliding Sync feature on Synapse versions between 1.113.0rc1 and 1.120.0 can leak partial room state changes to users no longer in a room. Non-state events, like messages, are unaffected. This vulnerability is fixed in 1.120.1.","status":"published","published":"2024-12-03T16:52:01.596Z","modified":"2024-12-03T19:07:19.919Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-497"],"updated_at":"2026-11-02T14:34:17.523201Z"}],"euvd":[{"id":"EUVD-2024-3430","description":"Synapse is an open-source Matrix homeserver. The Sliding Sync feature on Synapse versions between 1.113.0rc1 and 1.120.0 can leak partial room state changes to users no longer in a room. Non-state events, like messages, are unaffected. This vulnerability is fixed in 1.120.1.","status":"published","published":"2024-12-03T16:52:01Z","modified":"2024-12-03T19:07:19Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:41.773585Z"}],"ghsa":[{"id":"GHSA-56w4-5538-8v8h","title":"Synapse Matrix has a partial room state leak via Sliding Sync","description":"### Impact\nThe Sliding Sync feature on Synapse versions between 1.113.0rc1 and 1.120.0 can leak partial room state changes to users no longer in a room. Non-state events, like messages, are unaffected.\n\n### Patches\nSynapse version 1.120.1 fixes the problem.\n\n### Workarounds\nDisable Sliding Sync.\n\n### References\nhttps://github.com/matrix-org/matrix-spec-proposals/pull/4186\nhttps://github.com/element-hq/synapse/blob/d80cd57c54427687afcb48740d99219c88a0fff1/synapse/config/experimental.py#L341-L344\n\n### For more information\n\nIf you have any questions or comments about this advisory, please email us at [security at element.io](mailto:security@element.io).\n","status":"published","published":"2024-12-03T18:44:23Z","modified":"2024-12-03T18:44:25Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-497"],"updated_at":"2026-11-02T14:38:24.542211Z"}],"nvd":[{"id":"CVE-2024-53867","description":"Synapse is an open-source Matrix homeserver. The Sliding Sync feature on Synapse versions between 1.113.0rc1 and 1.120.0 can leak partial room state changes to users no longer in a room. Non-state events, like messages, are unaffected. This vulnerability is fixed in 1.120.1.","status":"published","published":"2024-12-03T17:15:12.787Z","modified":"2026-06-17T08:09:26.593Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-497"],"updated_at":"2026-11-02T14:10:38.973941Z"}],"osv":[{"id":"ALPINE-CVE-2024-53867","description":"Synapse is an open-source Matrix homeserver. The Sliding Sync feature on Synapse versions between 1.113.0rc1 and 1.120.0 can leak partial room state changes to users no longer in a room. Non-state events, like messages, are unaffected. This vulnerability is fixed in 1.120.1.","status":"published","published":"2024-12-03T17:15:12.787Z","modified":"2026-11-03T06:32:50.295659067Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T07:16:46.202932Z"},{"id":"CVE-2024-53867","title":"Synapse Matrix has a partial room state leak via Sliding Sync","description":"Synapse is an open-source Matrix homeserver. The Sliding Sync feature on Synapse versions between 1.113.0rc1 and 1.120.0 can leak partial room state changes to users no longer in a room. Non-state events, like messages, are unaffected. This vulnerability is fixed in 1.120.1.","status":"published","published":"2024-12-03T16:52:01.596Z","modified":"2026-10-28T02:30:37.596927855Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-497"],"updated_at":"2026-11-02T15:44:44.451316Z"},{"id":"DEBIAN-CVE-2024-53867","description":"Synapse is an open-source Matrix homeserver. The Sliding Sync feature on Synapse versions between 1.113.0rc1 and 1.120.0 can leak partial room state changes to users no longer in a room. Non-state events, like messages, are unaffected. This vulnerability is fixed in 1.120.1.","status":"withdrawn","published":"2024-12-03T17:15:12.787Z","modified":"2026-08-11T20:49:53.108916987Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:44.429177Z"},{"id":"GHSA-56w4-5538-8v8h","title":"Synapse Matrix has a partial room state leak via Sliding Sync","description":"### Impact\nThe Sliding Sync feature on Synapse versions between 1.113.0rc1 and 1.120.0 can leak partial room state changes to users no longer in a room. Non-state events, like messages, are unaffected.\n\n### Patches\nSynapse version 1.120.1 fixes the problem.\n\n### Workarounds\nDisable Sliding Sync.\n\n### References\nhttps://github.com/matrix-org/matrix-spec-proposals/pull/4186\nhttps://github.com/element-hq/synapse/blob/d80cd57c54427687afcb48740d99219c88a0fff1/synapse/config/experimental.py#L341-L344\n\n### For more information\n\nIf you have any questions or comments about this advisory, please email us at [security at element.io](mailto:security@element.io).\n","status":"published","published":"2024-12-03T18:44:23Z","modified":"2026-07-07T17:57:08.952627015Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-497"],"updated_at":"2026-11-02T15:46:37.864461Z"},{"id":"PYSEC-2026-1610","title":"Synapse Matrix has a partial room state leak via Sliding Sync","description":"### Impact\nThe Sliding Sync feature on Synapse versions between 1.113.0rc1 and 1.120.0 can leak partial room state changes to users no longer in a room. Non-state events, like messages, are unaffected.\n\n### Patches\nSynapse version 1.120.1 fixes the problem.\n\n### Workarounds\nDisable Sliding Sync.\n\n### References\nhttps://github.com/matrix-org/matrix-spec-proposals/pull/4186\nhttps://github.com/element-hq/synapse/blob/d80cd57c54427687afcb48740d99219c88a0fff1/synapse/config/experimental.py#L341-L344\n\n### For more information\n\nIf you have any questions or comments about this advisory, please email us at [security at element.io](mailto:security@element.io).\n","status":"published","published":"2026-07-07T14:34:46.676923Z","modified":"2026-07-07T17:47:03.468918922Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:55.06457Z"},{"id":"UBUNTU-CVE-2024-53867","description":"Synapse is an open-source Matrix homeserver. The Sliding Sync feature on Synapse versions between 1.113.0rc1 and 1.120.0 can leak partial room state changes to users no longer in a room. Non-state events, like messages, are unaffected. This vulnerability is fixed in 1.120.1.","status":"withdrawn","published":"2024-12-03T17:15:00Z","modified":"2025-07-16T07:21:12.057031Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:11.182485Z"},{"id":"openSUSE-SU-2024:14541-1","title":"matrix-synapse-1.120.2-1.1 on GA media","description":"These are all security issues fixed in the matrix-synapse-1.120.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-04T00:00:00Z","modified":"2026-02-04T03:36:32.200271Z","updated_at":"2026-11-02T16:58:36.976155Z"}]}}