Synapse is an open-source Matrix homeserver. Synapse before version 1.106 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the local homeserver in an unauthenticated way. The implication is that unauthenticated remote adversaries can use this functionality to plant problematic content into the media repository. Synapse 1.106 introduces a partial mitigation in the form of new endpoints which require authentication for media downloads. The unauthenticated endpoints will be frozen in a future release, closing the attack vector.
Metrics
Affected Vendors & Products
References
History
Tue, 26 Aug 2025 15:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Matrix
Matrix synapse |
|
CPEs | cpe:2.3:a:matrix:synapse:*:*:*:*:*:*:*:* | |
Vendors & Products |
Matrix
Matrix synapse |
Tue, 03 Dec 2024 19:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Element-hq
Element-hq synapse |
|
CPEs | cpe:2.3:a:element-hq:synapse:*:*:*:*:*:*:*:* | |
Vendors & Products |
Element-hq
Element-hq synapse |
|
Metrics |
ssvc
|
Tue, 03 Dec 2024 17:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | Synapse is an open-source Matrix homeserver. Synapse before version 1.106 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the local homeserver in an unauthenticated way. The implication is that unauthenticated remote adversaries can use this functionality to plant problematic content into the media repository. Synapse 1.106 introduces a partial mitigation in the form of new endpoints which require authentication for media downloads. The unauthenticated endpoints will be frozen in a future release, closing the attack vector. | |
Title | Synapse unauthenticated writes to the media repository allow planting of problematic content | |
Weaknesses | CWE-306 | |
References |
| |
Metrics |
cvssV3_1
|

Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2024-12-03T18:51:29.590Z
Reserved: 2024-06-05T20:10:46.497Z
Link: CVE-2024-37303

Updated: 2024-12-03T18:50:46.020Z

Status : Analyzed
Published: 2024-12-03T17:15:10.890
Modified: 2025-08-26T15:09:47.387
Link: CVE-2024-37303

No data.

No data.