CVE-2022-39335 - CVE House
Back to Database
Status published Medium CVE-2022-39335

Synapse does not apply enough checks to servers requesting auth events of events in a room

Vulnerability Description

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix Federation API allows remote homeservers to request the authorization events in a room. This is necessary so that a homeserver receiving some events can validate that those events are legitimate and permitted in their room. However, in versions of Synapse up to and including 1.68.0, a Synapse homeserver answering a query for authorization events does not sufficiently check that the requesting server should be able to access them. The issue was patched in Synapse 1.69.0. Homeserver administrators are advised to upgrade.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-39335

Credits & Attribution

No credits recorded in the NVD database.

References

More from matrix-org

View All →
CVE-2025-66622
matrix-sdk-base is vulnerable to DoS via custom m.room.join_rules event values
Low 1.3
CVE-2025-59160
matrix-js-sdk has insufficient validation when considering a room to be upgraded by another
Low 2.7
CVE-2025-59047
matrix-sdk-base has panic in the `RoomMember::normalized_power_level()` method
Low 2.7
CVE-2025-53549
Matrix Rust SDK allows SQL injection in the EventCache implementation
Medium 5.2
CVE-2025-48937
matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator
Medium 4.9

Affected Vendor

Affected Software

synapse
Vulnerable Versions:
< 1.69.0

Timeline

Official Publish: May 26th, 2023
Last Modified: February 13th, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Weaknesses (CWE)

CWE-200

MITRE ATT&CK TTPs

T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1041 Exfiltration Over C2 Channel
Exfiltration