CVE-2023-43796

Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queried from Synapse. This can be used to enumerate the remote users known to a homeserver. System administrators are encouraged to upgrade to Synapse 1.95.1 or 1.96.0rc1 to receive a patch. As a workaround, the `federation_domain_whitelist` can be used to limit federation traffic with a homeserver.

• CWE-200

• https://github.com/matrix-org/synapse/commit/daec55e1fe120c564240c5386e77941372bf458fPatch
• https://github.com/matrix-org/synapse/security/advisories/GHSA-mp92-3jfm-3575Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2IDEEZMFJBDLTFHQUTZRJJNCOZGQ2ZVS/Mailing List
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VH3RNC5ZPQZ4OKPSL4E6BBJSZOQLGDEY/Mailing List
• https://security.gentoo.org/glsa/202401-12
• https://github.com/matrix-org/synapse/commit/daec55e1fe120c564240c5386e77941372bf458fPatch
• https://github.com/matrix-org/synapse/security/advisories/GHSA-mp92-3jfm-3575Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2IDEEZMFJBDLTFHQUTZRJJNCOZGQ2ZVS/Mailing List
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VH3RNC5ZPQZ4OKPSL4E6BBJSZOQLGDEY/Mailing List
• https://security.gentoo.org/glsa/202401-12

Published

Oct 31, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-43790iTop is an IT service management platform. By manipulating …5.4
• CVE-2023-43791Label Studio is a multi-type data labeling and annotation to…8.8
• CVE-2023-43792baserCMS is a website development framework. In versions 4.6…9.8
• CVE-2023-43793Misskey is an open source, decentralized social media platfo…7.5
• CVE-2023-43794Nocodb is an open source Airtable alternative. Affected vers…4.9
• CVE-2023-43795GeoServer is an open source software server written in Java …9.8
• CVE-2023-43797BigBlueButton is an open-source virtual classroom. Prior to …5.4
• CVE-2023-43798BigBlueButton is an open-source virtual classroom. BigBlueBu…5.4
• CVE-2023-43799Altair is a GraphQL Client. Prior to version 5.2.5, the Alta…7.8
• CVE-2023-4380A logic flaw exists in Ansible Automation platform. Whenever…6.3
• CVE-2023-43800Arduino Create Agent is a package to help manage Arduino dev…7.8
• CVE-2023-43801Arduino Create Agent is a package to help manage Arduino dev…7.1