Security readout for executives and security teams
Plain-English summary
A vulnerable Matrix bridge can be tricked by a malicious admin of an existing bridged room into redirecting bridged traffic to another room without that target room's consent or awareness. The main business risk is confidentiality: messages intended for one bridged room may be exposed to an unintended room.
Executive priority
Treat as a targeted confidentiality risk for Matrix bridge operators, not a broad internet-wide emergency. Patch or disable automatic room upgrades promptly where bridges carry sensitive communications, because the flaw can redirect messages without consent once a bridged-room admin is malicious or compromised.
Technical view
matrix-appservice-bridge versions 2.6.0 and earlier mishandle automatic room upgrades when roomUpgradeOpts is enabled. The bridge accepts an m.room.tombstone target without verifying the target room's m.room.create predecessor points back to the prior room. A malicious bridged-room admin can repoint bridge traffic. Version 2.6.1 patched this.
Likely exposure
Exposure is limited to deployments using matrix-org matrix-appservice-bridge before 2.6.1 with automatic room upgrade handling enabled. Organizations not running this bridge, already on 2.6.1 or later, or without roomUpgradeOpts enabled are not described as affected by the supplied sources.
Exploitation context
The source bundle does not show known active exploitation, and KEV status is false. Abuse requires low privileges: administrative control of a bridged room. The impact is high confidentiality exposure, with no integrity or availability impact stated in the CVSS vector.
Researcher notes
The key validation point is configuration-dependent exposure: vulnerable version plus roomUpgradeOpts. Sources identify the missing predecessor check and the vendor patch, but do not provide evidence of exploitation in the wild. Avoid assuming affected downstream services unless they use matrix-appservice-bridge in the vulnerable configuration.
Mitigation direction
- Upgrade matrix-appservice-bridge to version 2.6.1 or later.
- If immediate upgrade is not possible, remove roomUpgradeOpts to disable automatic room upgrade handling.
- Review vendor advisory and release notes for deployment-specific guidance.
- Prioritize bridges carrying sensitive or regulated conversations.
Validation and detection
- Inventory deployed matrix-appservice-bridge versions and identify any below 2.6.1.
- Inspect bridge configuration for roomUpgradeOpts automatic upgrade handling.
- Confirm patched deployments run version 2.6.1 or later.
- Review bridged-room administration rights for unnecessary privileged users.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-306: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-32659 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N2.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/matrix-org/matrix-appservice-bridge/security/advisories/GHSA-35g4-qx3c-vjhxCVE reference · x_refsource_CONFIRM
- https://github.com/matrix-org/matrix-appservice-bridge/commit/b69e745584a34fcfd858df33e4631e420da07b9fCVE reference · x_refsource_MISC
- https://github.com/matrix-org/matrix-appservice-bridge/releases/tag/2.6.1CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authentication for Critical Function
Missing Authentication for Critical Function represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.