Improper Authorization in Dendrite Leading to Third-Party Identifier Removal

Executive Summary

CVE-2026-63095 is an improper authorization flaw in Dendrite through version 0.13.8. It allows any authenticated local user to delete third-party identifier bindings (emails or phone numbers) of other users via the Matrix Client-Server API without ownership verification. Attackers exploit this to remove a victim's email or MSISDN binding, then rebind it through an identity server to hijack the victim's password reset flow.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Dendrite version is 0.13.8 or earlier. Use commands like 'curl -X POST http://your-server/_matrix/client/v3/account/3pid/delete -H "Authorization: Bearer YOUR_TOKEN" -d '{"address":"[email protected]","medium":"email"}'' to test if unauthorized deletions are possible. Monitor logs for failed password reset attempts or unexpected third-party identifier removals.

For the SSRF vulnerability, test the media download endpoint with 'curl http://your-server/_matrix/media/v3/download/attacker.com/123' to see if internal network probing is possible. Check if the /context endpoint leaks room state to non-members.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to account takeover if an attacker deletes your email or phone number binding and then rebinds it to their account to intercept password reset requests. It may also allow unauthorized access to room state information and enable internal network scanning through SSRF.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, which may violate GDPR's data protection principles and HIPAA's safeguards for protected health information. Specifically, the improper authorization flaw allows attackers to delete third-party identifiers, potentially disrupting password resets and enabling account hijacking, compromising data integrity and access controls.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Dendrite to a patched version beyond 0.13.8. If upgrading is not possible, disable the vulnerable endpoints (/account/3pid/delete, /_matrix/media/{r0,v1,v3}/download/{serverName}/{mediaId}, and /context) or restrict access to trusted users only.

Review and revoke any recently deleted third-party identifiers. Implement strict input validation and ownership verification for all account management endpoints. Monitor for suspicious activity in password reset flows.

Useful 0 Not Useful 0