{"id":"CVE-2018-12423","aliases":["GHSA-ch5v-fhg8-7gv9","PYSEC-2026-844"],"title":"Matrix Synapse Authorization Error","summary":"Matrix Synapse Authorization Error","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","vendor":"matrix-synapse","product":"matrix-synapse","ecosystem":"pip","affected":["matrix-synapse < 0.31.2"],"patched":["matrix-synapse 0.31.2"],"published":"2022-05-13","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-ch5v-fhg8-7gv9","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12423"},{"url":"https://github.com/matrix-org/matrix-doc/issues/1304"},{"url":"https://bugs.debian.org/901549"},{"url":"https://github.com/matrix-org/synapse"},{"url":"https://matrix.org/blog/2018/06/14/security-update-synapse-0-31-2"}],"tags":["osv","pip"],"epss":0.01816,"epssPercentile":0.77403,"ingestedAt":"2026-07-08T18:25:48.386Z","slug":"CVE-2018-12423","body":"## Overview\n\nIn Synapse before 0.31.2, unauthorised users can hijack rooms when there is no `m.room.power_levels` event in force.\n\n## Affected packages\n\n- `matrix-synapse < 0.31.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `matrix-synapse 0.31.2`","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":0.4,"exploitation":0,"ransomware":0},"changes":[]}