CVE-2024-37303

Synapse is an open-source Matrix homeserver. Synapse before version 1.106 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the local homeserver in an unauthenticated way. The implication is that unauthenticated remote adversaries can use this functionality to plant problematic content into the media repository. Synapse 1.106 introduces a partial mitigation in the form of new endpoints which require authentication for media downloads. The unauthenticated endpoints will be frozen in a future release, closing the attack vector.

• CWE-306

• https://github.com/element-hq/synapse/security/advisories/GHSA-gjgr-7834-rhxrVendor Advisory
• https://github.com/matrix-org/matrix-spec-proposals/pull/3916Issue Tracking, Patch

Published

Dec 3, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-37298gorilla/schema converts structs to and from form values. Pri…7.5
• CVE-2024-37299Discourse is an open source discussion platform. Prior to 3.…7.5
• CVE-2024-3730The Simple Membership plugin for WordPress is vulnerable to …5.4
• CVE-2024-37300OAuthenticator is software that allows OAuth2 identity provi…8.1
• CVE-2024-37301Document Merge Service is a document template merge service …7.2
• CVE-2024-37302Synapse is an open-source Matrix homeserver. Synapse version…7.5
• CVE-2024-37304NuGet Gallery is a package repository that powers nuget.org.…6.1
• CVE-2024-37305oqs-provider is a provider for the OpenSSL 3 cryptography li…8.2
• CVE-2024-37306Computer Vision Annotation Tool (CVAT) is an interactive vid…7.1
• CVE-2024-37307Cilium is a networking, observability, and security solution…6.5
• CVE-2024-37308The Cooked Pro recipe plugin for WordPress is vulnerable to …5.4
• CVE-2024-37309CrateDB is a distributed SQL database. A high-risk vulnerabi…5.3