CVE-2021-39164

Matrix is an ecosystem for open federated Instant Messaging and Voice over
IP. In versions 1.41.0 and prior, unauthorised users can access the
membership (list of members, with their display names) of a room if they
know the ID of the room. The vulnerability is limited to rooms with
shared history visibility. Furthermore, the unauthorised user must be
using an account on a vulnerable homeserver that is in the room. Server
administrators should upgrade to 1.41.1 or later in order to receive the
patch. One workaround is available. Administrators of servers that use a
reverse proxy could, with potentially unacceptable loss of functionality,
block the endpoints: /_matrix/client/r0/rooms/{room_id}/members with at
query parameter, and /_matrix/client/unstable/rooms/{room_id}/members
with at query parameter.