CVE-2021-39164

LowCVSS 3.1/10Last modified Jun 17, 2026

Description

Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with `shared` history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room. Server administrators should upgrade to 1.41.1 or later in order to receive the patch. One workaround is available. Administrators of servers that use a reverse proxy could, with potentially unacceptable loss of functionality, block the endpoints: `/_matrix/client/r0/rooms/{room_id}/members` with `at` query parameter, and `/_matrix/client/unstable/rooms/{room_id}/members` with `at` query parameter.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Aug 31, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-391656.5Cachet is an open source status page. With Cachet prior to and including 2.3.18, there is a SQL injection which is in the `SearchableTrait#sCVE-2021-391665.4Pimcore is an open source data & experience management platform. Prior to version 10.1.2, text-values were not properly escaped before printCVE-2021-391679.8OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with thCVE-2021-391689.8OpenZepplin is a library for smart contract development. In affected versions a vulnerability in TimelockController allowed an actor with thCVE-2021-391695.4Misskey is a decentralized microblogging platform. In versions of Misskey prior to 12.51.0, malicious actors can use the web client built-inCVE-2021-39175.5A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. TCVE-2021-391705.4Pimcore is an open source data & experience management platform. Prior to version 10.1.2, an authenticated user could add XSS code as a valuCVE-2021-391717.5Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SACVE-2021-391728.8Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges (User or Admin), caCVE-2021-391738.8Cachet is an open source status page system. Prior to version 2.5.1 authenticated users, regardless of their privileges (User or Admin), canCVE-2021-391748.8Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges (User or Admin), caCVE-2021-391756.1HedgeDoc is a platform to write and share markdown. In versions prior to 1.9.0, an unauthenticated attacker can inject arbitrary JavaScript
CVE-2021-39164: Low severity, CVSS 3.1 | Vulnix