CVE-2026-63097: Dendrite Auth Bypass Vulnerability

CVE-2026-63097 Overview

CVE-2026-63097 is an improper access control vulnerability in Dendrite, a second-generation Matrix homeserver written in Go. The flaw affects Dendrite versions through 0.13.8 and resides in the syncapi/context endpoint implemented in syncapi/routing/context.go. The endpoint performs a flawed membership check that evaluates only the RoomExists field while ignoring IsInRoom, HasBeenInRoom, and Membership fields. Authenticated users who have left a room can still call the room context API for a previously permitted event and receive the current, unfiltered room state. This bypasses the history visibility controls correctly enforced by the /messages and /sync endpoints.

Critical Impact
Authenticated users who previously belonged to a room can retrieve current room state events after leaving, exposing member lists, topics, and other state that history visibility settings should withhold.

Affected Products

Dendrite Matrix homeserver versions through 0.13.8
Deployments exposing the syncapi/context endpoint
Federated Matrix environments relying on Dendrite for history visibility enforcement

Discovery Timeline

2026-07-17 - CVE-2026-63097 published to the National Vulnerability Database
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-63097

Vulnerability Analysis

Dendrite exposes the Matrix client-server /rooms/{roomId}/context/{eventId} endpoint through its sync API component. The handler in syncapi/routing/context.go is responsible for returning an event, its surrounding messages, and the room state at that point in time. Correct enforcement requires validating that the caller currently has permission to view the room state, taking history visibility rules into account.

The implementation only inspects the RoomExists boolean returned from an internal membership query. It does not consult IsInRoom, HasBeenInRoom, or Membership. As a result, any authenticated user who at some point held a valid membership can query the endpoint against an event identifier they previously observed. The response includes the current room state rather than the state filtered by the caller's visibility. This vulnerability is classified under [CWE-863] Incorrect Authorization.

Root Cause

The root cause is an incomplete authorization predicate. Membership evaluation collapses to a single field that indicates only room existence in the local server view. Fields describing the caller's actual membership status are populated by the query but never referenced by the handler. Peer endpoints such as /messages and /sync implement the full check and are not affected.

Attack Vector

Exploitation requires authenticated local access to the Matrix homeserver and knowledge of an event identifier within the target room. An attacker who was previously a member and retained event IDs from that period can leave the room, then issue an authenticated HTTP GET to the context endpoint referencing the retained event. The server returns the room's current state events, including membership lists and topic changes that occurred after the attacker departed. No further privilege is required, and the interaction is a single request against the network-accessible sync API.

No verified public exploit code is available. See the GitHub Dendrite Room State Bypass writeup and the VulnCheck Advisory on Dendrite Exposure for technical details.

Detection Methods for CVE-2026-63097

Indicators of Compromise

Authenticated requests to /_matrix/client/*/rooms/{roomId}/context/{eventId} from users whose current membership state for that room is leave or ban.
Repeated context endpoint queries referencing historic event IDs shortly after a membership change event for the same user.
HTTP 200 responses from the context endpoint immediately following a room-leave event for the requesting account.

Detection Strategies

Correlate m.room.member state transitions with subsequent /context API calls to identify former members retrieving state.
Enable verbose access logging on the Dendrite syncapi component and alert on context endpoint access by users not present in the room's current member list.
Compare responses returned by /context against those returned by /messages and /sync for the same user and room to identify inconsistent visibility.

Monitoring Recommendations

Ingest Dendrite HTTP access logs into a centralized log platform and build queries that join membership changes with context endpoint activity.
Track the volume of /context requests per user and room, alerting on spikes from accounts that recently left rooms.
Retain sync API logs for at least 30 days to support retrospective investigation of history visibility bypass attempts.

How to Mitigate CVE-2026-63097

Immediate Actions Required

Upgrade Dendrite to a version later than 0.13.8 that corrects the membership evaluation in syncapi/routing/context.go.
Audit recent /context endpoint access for authenticated users who are no longer members of the referenced rooms.
Notify room administrators of sensitive rooms so they can rotate any secrets or invitations that may have been exposed in state events.

Patch Information

Refer to the VulnCheck Advisory on Dendrite Exposure and the GitHub Dendrite Room State Bypass writeup for fixed version details. The corrected handler must evaluate IsInRoom, HasBeenInRoom, and Membership in addition to RoomExists before returning room state.

Workarounds

Restrict access to the Dendrite syncapi/context endpoint at a reverse proxy layer until the server is patched.
Limit registration on the homeserver and revoke access tokens for users who have left sensitive rooms to reduce the attacker population.
Move highly sensitive discussions to rooms configured with strict history_visibility of joined and rotate room identifiers after suspected exposure.

bash

# Example reverse-proxy block for the vulnerable endpoint (nginx)
location ~ ^/_matrix/client/.*/rooms/.*/context/ {
    return 403;
}