Read the docs
TI-2022-16434 Aliases CVE-2022-36009GHSA-grvv-h2f9-7v9c

Incorrect parsing of access level in gomatrixserverlib and dendrite

Priority MEDIUM 40CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

gomatrixserverlib is a Go library for matrix protocol federation. Dendrite is a Matrix homeserver written in Go, an alternative to Synapse. The power level parsing within gomatrixserverlib was failing to parse the `"events_default"` key of the `m.room.power_levels` event, defaulting the event default power level to zero in all cases. Power levels are the matrix terminology for user access level. In rooms where the `"events_default"` power level had been changed, this could result in events either being incorrectly authorised or rejected by Dendrite servers. gomatrixserverlib contains a fix as of commit `723fd49` and Dendrite 0.9.3 has been updated accordingly. Matrix rooms where the `"events_default"` power level has not been changed from the default of zero are not vulnerable. Users are advised to upgrade. There are no known workarounds for this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00859 58th percentileScored 2026-11-07
Fix Fixed github.com/matrix-org/dendrite (Go): 0.9.3github.com/matrix-org/gomatrixserverlib (Go): 0.0.0-20220815091947-723fd495dde8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
matrix-orggomatrixserverlib< 0.9.3 for dendrite; < 723fd49 for gomatrixserverlib—No fix listedCNA
—github.com/matrix-org/dendrite (Go)before 0.9.30.9.3Patch availableGHSA-grvv-h2f9-7v9c
—github.com/matrix-org/gomatrixserverlib (Go)before 0.0.0-20220815091947-723fd495dde80.0.0-20220815091947-723fd495dde8Patch availableGHSA-grvv-h2f9-7v9c
  • gomatrixserverlib Vendormatrix-org Affected < 0.9.3 for dendrite; < 723fd49 for gomatrixserverlib Fixed in — No fix listed CNA
  • github.com/matrix-org/dendrite (Go) Vendor— Affected before 0.9.3 Fixed in 0.9.3 Patch available GHSA-grvv-h2f9-7v9c
  • github.com/matrix-org/gomatrixserverlib (Go) Vendor— Affected before 0.0.0-20220815091947-723fd495dde8 Fixed in 0.0.0-20220815091947-723fd495dde8 Patch available GHSA-grvv-h2f9-7v9c

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:matrix:dendrite:*:*:*:*:*:*:*:*up to 0.9.2Vulnerablematrix-org
cpe:2.3:a:matrix:gomatrixserverlib:-:*:*:*:*:*:*:*not specified by NVDVulnerablematrix-org
  • cpe:2.3:a:matrix:dendrite:*:*:*:*:*:*:*:* Versions up to 0.9.2 Vulnerable ·matrix-org
  • cpe:2.3:a:matrix:gomatrixserverlib:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·matrix-org

Remediation

  • Fix · GHSA-grvv-h2f9-7v9c github.com/matrix-org/dendrite (Go) Fixed in 0.9.3 Advisory →
  • Fix · GHSA-grvv-h2f9-7v9c github.com/matrix-org/gomatrixserverlib (Go) Fixed in 0.0.0-20220815091947-723fd495dde8 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-36009
  2. 2026-10-03 Alias added: GHSA-grvv-h2f9-7v9c

References

Patch 1

Advisory 3

Other 2

  • TI-2022-18580 Signature checks not applied to some retrieved missing events CVSS 3.1HIGH 7.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences