matrix_synapse is vulnerable to privilege escalation. An unauthorised user knowing Room ID of a private room and setting room’s history visibility to shared
is allowed to enumerate the room’s members, including their display names.
github.com/matrix-org/synapse/commit/cb35df940a
github.com/matrix-org/synapse/releases/tag/v1.41.1
github.com/matrix-org/synapse/security/advisories/GHSA-3x4c-pq33-4w3q
lists.fedoraproject.org/archives/list/[email protected]/message/2VHDEPCZ22GJFMZCWA2XZAGPOEV72POF/
lists.fedoraproject.org/archives/list/[email protected]/message/PXT7ID7DNBRN2TVTETU3SYQHJKEG6PXN/