CVE-2021-32659

Matrix-appservice-bridge is the bridging service for the Matrix communication program's application services. In versions 2.6.0 and earlier, if a bridge has room upgrade handling turned on in the configuration (the `roomUpgradeOpts` key when instantiating a new `Bridge` instance.), any `m.room.tombstone` event it encounters will be used to unbridge the current room and bridge into the target room. However, the target room `m.room.create` event is not checked to verify if the `predecessor` field contains the previous room. This means that any malicious admin of a bridged room can repoint the traffic to a different room without the new room being aware. Versions 2.6.1 and greater are patched. As a workaround, disabling the automatic room upgrade handling can be done by removing the `roomUpgradeOpts` key from the `Bridge` class options.

• CWE-306

• https://github.com/matrix-org/matrix-appservice-bridge/commit/b69e745584a34fcfd858df33e4631e420da07b9fPatch, Third Party Advisory
• https://github.com/matrix-org/matrix-appservice-bridge/releases/tag/2.6.1Patch, Third Party Advisory
• https://github.com/matrix-org/matrix-appservice-bridge/security/advisories/GHSA-35g4-qx3c-vjhxMitigation, Third Party Advisory
• https://github.com/matrix-org/matrix-appservice-bridge/commit/b69e745584a34fcfd858df33e4631e420da07b9fPatch, Third Party Advisory
• https://github.com/matrix-org/matrix-appservice-bridge/releases/tag/2.6.1Patch, Third Party Advisory
• https://github.com/matrix-org/matrix-appservice-bridge/security/advisories/GHSA-35g4-qx3c-vjhxMitigation, Third Party Advisory

Published

Jun 16, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32653Nextcloud Server is a Nextcloud package that handles data st…2.7
• CVE-2021-32654Nextcloud Server is a Nextcloud package that handles data st…9.1
• CVE-2021-32655Nextcloud Server is a Nextcloud package that handles data st…3.5
• CVE-2021-32656Nextcloud Server is a Nextcloud package that handles data st…8.6
• CVE-2021-32657Nextcloud Server is a Nextcloud package that handles data st…4.3
• CVE-2021-32658Nextcloud Android is the Android client for the Nextcloud op…4.6
• CVE-2021-32660Backstage is an open platform for building developer portals…8.1
• CVE-2021-32661Backstage is an open platform for building developer portals…7.3
• CVE-2021-32662Backstage is an open platform for building developer portals…6.5
• CVE-2021-32663iTop is an open source web based IT Service Management tool.…7.5
• CVE-2021-32664Combodo iTop is an open source web based IT Service Manageme…4.8
• CVE-2021-32665wire-ios is the iOS version of Wire, an open-source secure m…6.5