Improper authorisation of members discloses room membership to non-members

Impact

Unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with shared history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room.

Patches

Server administrators should upgrade to 1.41.1 or later.

Workarounds

Administrators of servers that use a reverse proxy could, with potentially unacceptable loss of functionality, block the following endpoints:

• /_matrix/client/r0/rooms/{room_id}/members with at query parameter
• /_matrix/client/unstable/rooms/{room_id}/members with at query parameter

References

n/a

For more information

If you have any questions or comments about this advisory, e-mail us at security@matrix.org.