CVE-2026-45076

Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, in federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients. Clients could therefore fail to display room history. This vulnerability is fixed in 1.152.1.

CVSS v3 2.7 LOW

2.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/element-hq/synapse/security/advisories/GHSA-6qf2-7x63-mm6v	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:element:synapse:*:*:*:*:*:*:*:*

History

26 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Synapse es una implementación de homeserver de Matrix de código abierto. Antes de la versión 1.152.1, en salas federadas, los homeservers maliciosos pueden manipular eventos de sala de tal manera que impida a Synapse proporcionar el historial completo a los clientes que paginan. Los clientes, por lo tanto, podrían no mostrar el historial de la sala. Esta vulnerabilidad está corregida en la versión 1.152.1.

Information

Published : 2026-05-28 17:16

Updated : 2026-10-26 13:10

NVD link : CVE-2026-45076

Mitre link : CVE-2026-45076

CVE.ORG link : CVE-2026-45076

JSON object : View

Products Affected

element

synapse

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2026-45076", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45076", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-02T14:51:22.795858Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.2}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "element-hq", "product": "synapse", "versions": [{"status": "affected", "version": "< 1.152.1"}]}]}], "published": "2026-05-28T17:16:31.590", "references": [{"url": "https://github.com/element-hq/synapse/security/advisories/GHSA-6qf2-7x63-mm6v", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Synapse is an open source Matrix homeserver implementation. Prior to 1.152.1, in federated rooms, malicious homeservers can craft room events in such a way that prevents Synapse from providing full history to paginating clients. Clients could therefore fail to display room history. This vulnerability is fixed in 1.152.1."}, {"lang": "es", "value": "Synapse es una implementaci\u00f3n de homeserver de Matrix de c\u00f3digo abierto. Antes de la versi\u00f3n 1.152.1, en salas federadas, los homeservers maliciosos pueden manipular eventos de sala de tal manera que impida a Synapse proporcionar el historial completo a los clientes que paginan. Los clientes, por lo tanto, podr\u00edan no mostrar el historial de la sala. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.152.1."}], "lastModified": "2026-10-26T13:10:00.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:element:synapse:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "30470335-8DE4-4DE9-84B0-09D11E4A2D70", "versionEndExcluding": "1.152.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}