Security readout for executives and security teams
Plain-English summary
CVE-2018-12291 is a Matrix Synapse federation privacy bug fixed in version 0.31.1. In affected versions, a federation API for missing events did not correctly apply event visibility rules, potentially exposing events that should have been hidden.
Executive priority
Prioritize remediation for federated Matrix Synapse deployments because the issue concerns access control around message events. If Synapse is not used, this CVE is not relevant.
Technical view
The issue is in handlers/federation.py, specifically on_get_missing_events and the get_missing_events federation API. Matrix Synapse versions before 0.31.1 are described as affected because event visibility checks were applied incorrectly during federation event retrieval.
Likely exposure
Exposure is likely limited to organizations running Matrix Synapse before 0.31.1, especially homeservers participating in Matrix federation. The source bundle does not identify affected CPEs, deployment prerequisites, or exact data exposure boundaries.
Exploitation context
The source bundle does not show known active exploitation, public exploit use, or KEV listing. Treat this as a federation access-control and confidentiality issue, not as a confirmed exploited vulnerability.
Researcher notes
Evidence is sparse: no CVSS, CWE, CPE list, exploit status, or detailed impact statement is provided. The strongest supported conclusion is that Synapse before 0.31.1 mishandled visibility enforcement in get_missing_events.
Mitigation direction
- Upgrade Matrix Synapse to version 0.31.1 or later.
- Review the Matrix Synapse 0.31.1 release notes.
- Review the linked upstream pull request for fix context.
- Check current vendor guidance if maintaining legacy Synapse versions.
Validation and detection
- Inventory all Matrix Synapse homeservers and recorded versions.
- Confirm no production server runs Synapse before 0.31.1.
- Identify whether each homeserver participates in Matrix federation.
- Review security notes for rooms relying on event visibility controls.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-12291 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/matrix-org/synapse/releases/tag/v0.31.1CVE reference · x_refsource_CONFIRM
- https://github.com/matrix-org/synapse/pull/3371CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.