Impact When a remote homeserver requests the event ID of the nearest event to a particular timestamp via the federation ""/timestamp_to_event"" (https://spec.matrix.org/v1.19/server-server-api/#get_matrixfederationv1timestamp_to_eventroomid) endpoint, Synapse does not verify that the requesting homeserver is in the room before handling the request. This leads to unintended disclosure of event IDs to any homeserver that knows the room ID. Homeservers that do not federate or only participate in a closed, trusted federation are not affected. ### Patches Update to Synapse 1.157.2 or later. See the table below for patched versions of "Element Server Suite" (https://element.io/en/server-suite), including Long-Term Support (LTS) versions. | | 25.10 LTS | 26.4 LTS | Latest | |:--|--|--|--| | ESS Pro | "25.10.14+lts" | "26.4.9+lts" | "26.7.2" | | ESS Classic | "25.10.09-gui" | "26.04.04-gui" | ⸻ | | ESS Community | ⸻ | ⸻ | "26.7.2" | | ESS TI-Messenger | "25.10.10" | "26.4.5" | "26.7.0" | ### Workarounds None known. ### Identifiers - ELEMENTSEC-2026-1718 ### For more information If you have any questions or comments about this advisory, please email us at "security at element.io" (mailto:security@element.io).