{"id":"GHSA-35g4-qx3c-vjhx","summary":"Automatic room upgrade handling can be used maliciously to bridge a room non-consentually ","details":"### Impact\n\nIf a bridge has room upgrade handling turned on in the configuration (the `roomUpgradeOpts` key when instantiating a new `Bridge` instance.), any `m.room.tombstone` event it encounters will be used to unbridge the current room and bridge into the target room. However, the target room `m.room.create` event is not checked to verify if the `predecessor` field contains the previous room. This means that any mailcious admin of a bridged room can repoint the traffic to a different room without the new room being aware.\n\n\n### Patches\n\nVersions 2.6.1 and greater are patched.\n\n### Workarounds\n\nDisabling the automatic room upgrade handling can be done by removing the `roomUpgradeOpts` key from the `Bridge` class options. \n\n### References\n\nThe issue is patched by https://github.com/matrix-org/matrix-appservice-bridge/pull/330\n\n### For more information]\n\nIf you have any questions or comments about this advisory, email us at security@matrix.org.","aliases":["CVE-2021-32659"],"modified":"2026-07-08T06:29:05.568084068Z","published":"2021-06-21T17:09:22Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2021-06-16T20:08:37Z","nvd_published_at":"2021-06-16T19:15:00Z","cwe_ids":["CWE-306"],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/matrix-org/matrix-appservice-bridge/security/advisories/GHSA-35g4-qx3c-vjhx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32659"},{"type":"WEB","url":"https://github.com/matrix-org/matrix-appservice-bridge/pull/330"},{"type":"WEB","url":"https://github.com/matrix-org/matrix-appservice-bridge/commit/b69e745584a34fcfd858df33e4631e420da07b9f"},{"type":"WEB","url":"https://github.com/matrix-org/matrix-appservice-bridge/releases/tag/2.6.1"}],"affected":[{"package":{"name":"matrix-appservice-bridge","ecosystem":"npm","purl":"pkg:npm/matrix-appservice-bridge"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/06/GHSA-35g4-qx3c-vjhx/GHSA-35g4-qx3c-vjhx.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}]}