Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2023-32682

Improper Authentication

Published: Jun 06, 2023 | Modified: Nov 21, 2024
CVSS 3.x
5.4
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu
MEDIUM
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2023-32682
CWEhttps://cwe.mitre.org/data/definitions/287.html

Synapse is a Matrix protocol homeserver written in Python with the Twisted framework. In affected versions it may be possible for a deactivated user to login when using uncommon configurations. This only applies if any of the following are true: 1. JSON Web Tokens are enabled for login via the jwt_config.enabled configuration setting. 2. The local password database is enabled via the password_config.enabled and password_config.localdb_enabled configuration settings and a users password is updated via an admin API after a user is deactivated. Note that the local password database is enabled by default, but it is uncommon to set a users password after theyve been deactivated. Installations that are configured to only allow login via Single Sign-On (SSO) via CAS, SAML or OpenID Connect (OIDC); or via an external password provider (e.g. LDAP) are not affected. If not using JSON Web Tokens, ensure that deactivated users do not have a password set. This issue has been addressed in version 1.85.0. Users are advised to upgrade.

Weakness

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected Software

NameVendorStart VersionEnd Version
SynapseMatrix*1.85.0 (excluding)
Matrix-synapseUbuntubionic*
Matrix-synapseUbuntuesm-apps/bionic*
Matrix-synapseUbuntuesm-apps/focal*
Matrix-synapseUbuntuesm-apps/jammy*
Matrix-synapseUbuntufocal*
Matrix-synapseUbuntujammy*
Matrix-synapseUbuntukinetic*
Matrix-synapseUbuntulunar*
Matrix-synapseUbuntumantic*
Matrix-synapseUbuntutrusty*
Matrix-synapseUbuntuupstream*
Matrix-synapseUbuntuxenial*

Potential Mitigations

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use