Impact Local authenticated users that are conspiring with, or tricked by, a malicious federated homeserver can cause room aliases to have their destination room changed. Homeservers that do not federate or only participate in a closed, trusted federation are not affected. Homeservers that only have trusted local users are only vulnerable when a local user could be tricked into joining a malicious federated room. ### Patches Update to Synapse 1.157.2 or later. See the table below for patched versions of "Element Server Suite" (https://element.io/en/server-suite), including Long-Term Support (LTS) versions. | | 25.10 LTS | 26.4 LTS | Latest | |:--|--|--|--| | ESS Pro | "25.10.14+lts" | "26.4.9+lts" | "26.7.2" | | ESS Classic | "25.10.09-gui" | "26.04.04-gui" | ⸻ | | ESS Community | ⸻ | ⸻ | "26.7.2" | | ESS TI-Messenger | "25.10.10" | "26.4.5" | "26.7.0" | ### Workarounds - Avoid joining untrusted remote rooms (rooms that the homeserver is not already part of). ### Identifiers - ELEMENTSEC-2026-1729 ### For more information If you have any questions or comments about this advisory, please email us at "security at element.io" (mailto:security@element.io).