The flaw in Dendrite’s syncapi /context endpoint performs an incomplete membership check, validating only that the room exists while disregarding the user’s current membership status. Because the check ignores flags such as IsInRoom, HasBeenInRoom and Membership, an authenticated local user who has already left a room can request the context for that room and obtain the full current state. This bypasses the protections that the /messages and /sync endpoints apply, allowing a post‑leave operator to read potentially confidential room state data that was not intended for them. The vulnerability represents improper access control (CWE‑863).

The weakness exists in matrix‑org’s Dendrite server version 0.13.8 and all earlier releases. An attacker must be a local authenticated user within the same server instance. Users who have logged in previously but subsequently left a room are the only ones who can exploit the flaw; the problem does not affect guests or remote unauthenticated traffic. Future releases beyond 0.13.8 are not listed as affected, implying remediation in those versions.

With a CVSS score of 5.3 the risk is moderate. The EPSS score is less than 1%, indicating a low probability of exploitation in the wild. The vulnerability is not present in the CISA KEV catalog. Exploitation requires no special privileges beyond a normal local login; once authenticated the attacker only needs to target the /context endpoint for a room previously joined but subsequently left. The flaw bypasses normal membership checks, so the attacker can read the room’s current state without further authorization, potentially leaking sensitive information.