CVE-2026-63097: matrix-org dendrite Incorrect Authorization

Vulnerability summary

CVE-2026-63097 is a medium (CVSS 5.3) Incorrect Authorization vulnerability in matrix-org dendrite. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 17.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 17-07-2026
   PublishedVulnerability first disclosed.
2. 28-07-2026
   Last modifiedVulnerability information updated.

Description

Dendrite through 0.13.8 contains an improper access control vulnerability in the syncapi /context endpoint (syncapi/routing/context.go) that allows authenticated local users to access post-leave room state events by exploiting a flawed membership check that evaluates only the RoomExists field while ignoring IsInRoom, HasBeenInRoom, and Membership fields. Attackers who have left a room can call the rooms context API endpoint for a previously permitted event and receive unfiltered current room state that the /messages and /sync endpoints correctly withhold.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.