Impact
Unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with shared history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room.
Patches
Server administrators should upgrade to 1.41.1 or later.
Workarounds
Administrators of servers that use a reverse proxy could, with potentially unacceptable loss of functionality, block the following endpoints:
/_matrix/client/r0/rooms/{room_id}/members with at query parameter/_matrix/client/unstable/rooms/{room_id}/members with at query parameter
References
n/a
For more information
If you have any questions or comments about this advisory, e-mail us at security@matrix.org.
References
0xkasper Analyst
Impact
Unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with
sharedhistory visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room.Patches
Server administrators should upgrade to 1.41.1 or later.
Workarounds
Administrators of servers that use a reverse proxy could, with potentially unacceptable loss of functionality, block the following endpoints:
/_matrix/client/r0/rooms/{room_id}/memberswithatquery parameter/_matrix/client/unstable/rooms/{room_id}/memberswithatquery parameterReferences
n/a
For more information
If you have any questions or comments about this advisory, e-mail us at security@matrix.org.
References