Authorization Bypass

2022-08-2205:58:55

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

github

matrix-org

dendrite

authorization bypass

software vulnerability

eventcontent.go

power levels

server rejection

EPSS

0.002

Percentile

60.7%

JSON

github.com/matrix-org/dendrite is vulnerable to authorization bypass. The vulnerability exists in the events_default level in m.room.power_levels events of eventcontent.go when defaulting the event default power level to zero in all cases, resulting in events either being incorrectly authorized or rejected by dendrite servers.