Synapse has improper checks for deactivated users during login
Impact
It may be possible for a deactivated user to login when using uncommon configurations.
This only applies if any of the following are true:
- JSON Web Tokens are enabled for login via the
jwt_config.enabledconfiguration setting - The local password database is enabled via the
password_config.enabledandpassword_config.localdb_enabledconfiguration settings and a user's password is updated via an admin API after a user is deactivated.
Note that the local password database is enabled by default, but it is uncommon to set a user's password after they've been deactivated.
Installations that are configured to only allow login via Single Sign-On (SSO) via CAS, SAML or OpenID Connect (OIDC); or via an external password provider (e.g. LDAP) are not affected.
Patches
- If using JSON Web Token logins: #15624
- For other users: #15634
Workarounds
If not using JSON Web Tokens, ensure that deactivated users do not have a password set. This list of users can be queried from PostgreSQL:
SELECT name FROM users WHERE password_hash IS NOT NULL AND deactivated = 1;Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | matrix-synapse | < 1.85.0 | 1.85.0 |
References
- https://github.com/matrix-org/synapse/security/advisories/GHSA-26c5-ppr8-f33p
- https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#password_config
- https://github.com/matrix-org/synapse/pull/15624
- https://matrix-org.github.io/synapse/latest/admin_api/user_admin_api.html#create-or-modify-account
- https://matrix-org.github.io/synapse/latest/jwt.html
- https://github.com/matrix-org/synapse/pull/15634
- https://nvd.nist.gov/vuln/detail/CVE-2023-32682
- https://github.com/matrix-org/synapse/issues/12274
- https://github.com/matrix-org/synapse
- https://github.com/matrix-org/synapse/releases/tag/v1.85.0
- https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2023-84.yaml
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6DH5A5YEB5LRIPP32OUW25FCGZFCZU2
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N- Weakness (CWE)
CWE-287- Platform
- Python (PyPI)
- Package
matrix-synapse- Disclosed
- 06.06.2023
- Updated
- 11.10.2026 15:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2023-84 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-26c5-ppr8-f33p - CC BY 4.0
Vulnerability history: matrix-synapse
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 45
- First → latest
- 03.2019 05.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 21
- Medium 21
- Low 3
Disclosures per year
- 2019: 3
- 2020: 3
- 2021: 12
- 2022: 7
- 2023: 9
- 2024: 7
- 2025: 2
- 2026: 2
-
Synapse has improper checks for deactivated users during login this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.