Dendrite’s DELETE endpoint for third‑party identifiers verifies authentication but fails to check ownership. Any authenticated user can delete another user's email or phone bindings. Exploiting this flaw allows an attacker to remove a victim’s identifier and rebind it via an identity server, potentially hijacking that user’s password reset flow. The flaw is a misuse of access control (CWE‑639).

Matrix‑org’s Dendrite 0.13.8 and earlier iterations are affected. The vulnerability lies in the Matrix Client‑Server API and applies to any Dendrite deployment using those versions.

The CVSS score of 7.1 indicates high severity. However, an EPSS below 1% suggests the current likelihood of exploitation is very low, and it is not listed in the CISA KEV catalog. Attackers must first authenticate to the server, making the threat primarily for insiders or compromised accounts. Once authenticated, the attacker can delete any other user’s third‑party identifier, then re‑associate that address to hijack password‑reset mechanisms. No remote or arbitrary code execution is possible; the impact focuses on identity hijacking and potential account takeover.