Impact When a malicious remote homeserver requests missing events using the federation ""/get_missing_events"" (https://spec.matrix.org/v1.19/server-server-api/#post_matrixfederationv1get_missing_eventsroomid) endpoint, Synapse does not verify that the requested events are in the room with the given room ID. This can cause events from another room to be disclosed, without the malicious server needing to be joined to that room. This is only exploitable if the malicious homeserver is joined to some room on the victim homeserver. Homeservers that do not federate or only participate in a closed, trusted federation are not affected. ### Patches Update to Synapse 1.157.2 or later. See the table below for patched versions of "Element Server Suite" (https://element.io/en/server-suite), including Long-Term Support (LTS) versions. | | 25.10 LTS | 26.4 LTS | Latest | |:--|--|--|--| | ESS Pro | "25.10.14+lts" | "26.4.9+lts" | "26.7.2" | | ESS Classic | "25.10.09-gui" | "26.04.04-gui" | ⸻ | | ESS Community | ⸻ | ⸻ | "26.7.2" | | ESS TI-Messenger | "25.10.10" | "26.4.5" | "26.7.0" | ### Workarounds None known. ### Identifiers - ELEMENTSEC-2026-1717 ### For more information If you have any questions or comments about this advisory, please email us at "security at element.io" (mailto:security@element.io).