CVE-2022-36009

gomatrixserverlib is a Go library for matrix protocol federation. Dendrite is a Matrix homeserver written in Go, an alternative to Synapse. The power level parsing within gomatrixserverlib was failing to parse the `"events_default"` key of the `m.room.power_levels` event, defaulting the event default power level to zero in all cases. Power levels are the matrix terminology for user access level. In rooms where the `"events_default"` power level had been changed, this could result in events either being incorrectly authorised or rejected by Dendrite servers. gomatrixserverlib contains a fix as of commit `723fd49` and Dendrite 0.9.3 has been updated accordingly. Matrix rooms where the `"events_default"` power level has not been changed from the default of zero are not vulnerable. Users are advised to upgrade. There are no known workarounds for this issue.

• CWE-863

• https://github.com/matrix-org/gomatrixserverlib/commit/723fd495dde835d078b9f2074b6b62c06dea4575Patch, Third Party Advisory
• https://github.com/matrix-org/gomatrixserverlib/security/advisories/GHSA-grvv-h2f9-7v9cThird Party Advisory
• https://matrix.org/docs/guides/moderation/#power-levelsVendor Advisory
• https://github.com/matrix-org/gomatrixserverlib/commit/723fd495dde835d078b9f2074b6b62c06dea4575Patch, Third Party Advisory
• https://github.com/matrix-org/gomatrixserverlib/security/advisories/GHSA-grvv-h2f9-7v9cThird Party Advisory
• https://matrix.org/docs/guides/moderation/#power-levelsVendor Advisory

Published

Aug 19, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-36003TensorFlow is an open source platform for machine learning. …7.5
• CVE-2022-36004TensorFlow is an open source platform for machine learning. …7.5
• CVE-2022-36005TensorFlow is an open source platform for machine learning. …7.5
• CVE-2022-36006Arvados is an open source platform for managing, processing,…8.8
• CVE-2022-36007Venice is a Clojure inspired sandboxed Lisp dialect with exc…3.3
• CVE-2022-36008Frontier is Substrate's Ethereum compatibility layer. A secu…6.5
• CVE-2022-3601The Image Hover Effects Css3 WordPress plugin through 4.5 do…4.8
• CVE-2022-36010This library allows strings to be parsed as functions and st…9.8
• CVE-2022-36011TensorFlow is an open source platform for machine learning. …7.5
• CVE-2022-36012TensorFlow is an open source platform for machine learning. …7.5
• CVE-2022-36013TensorFlow is an open source platform for machine learning. …7.5
• CVE-2022-36014TensorFlow is an open source platform for machine learning. …7.5