Impact On some endpoints, Synapse will accept extraneous (suffix) data on the path of some endpoints. When Synapse is protected by a reverse proxy (such as Nginx) and the reverse proxy normalises paths when routing (e.g. by converting "/a/../b" to "/b" for routing purposes), this can lead to a bypass of reverse proxy rules, allowing unintended endpoints to be exposed. This constitutes a loss of defence in depth, and should not be directly exploitable, due to sensitive endpoints, such as Admin APIs, needing a valid access token for use. ### Patches Update to Synapse 1.157.2 or later. See the table below for patched versions of "Element Server Suite" (https://element.io/en/server-suite), including Long-Term Support (LTS) versions. | | 25.10 LTS | 26.4 LTS | Latest | |:--|--|--|--| | ESS Pro | "25.10.14+lts" | "26.4.9+lts" | "26.7.2" | | ESS Classic | "25.10.09-gui" | "26.04.04-gui" | ⸻ | | ESS Community | ⸻ | ⸻ | "26.7.2" | | ESS TI-Messenger | "25.10.10" | "26.4.5" | "26.7.0" | ### Workarounds - Configure your reverse proxy not to use normalised paths for routing purposes. (i.e. "/a/../b" should be treated as a subpath of "/a", not of "/b") - If applicable, avoid relying on reverse proxy rules alone to protect sensitive endpoints; instead "configure multiple listeners" (https://element-hq.github.io/synapse/v1.157/usage/configuration/config_documentation.html?highlight=resources#listeners) and segregate sensitive endpoints onto their own port that way. ### Identifiers - ELEMENTSEC-2026-1760 ### For more information If you have any questions or comments about this advisory, please email us at "security at element.io" (mailto:security@element.io).