CVE-2026-63097 is an improper access control vulnerability in matrix-org's Dendrite (<=0.13.8) affecting the syncapi /context endpoint. The issue is due to a flawed membership check that evaluates only the RoomExists field while ignoring IsInRoom, HasBeenInRoom, and Membership fields. Consequently, authenticated users who have left a room can call the rooms context API endpoint and retrieve unfiltered current room state events that should be withheld. This contrasts with the /messages and /sync endpoints, which correctly enforce membership restrictions. The vulnerability allows unauthorized access to sensitive room state information post-leave.

Authenticated users who have left a room can access current room state events through the /context endpoint, which should be restricted. This improper authorization could lead to unintended disclosure of room state information that is otherwise protected by other endpoints. The vulnerability does not require user interaction and has a network attack vector with low complexity. The CVSS 4.0 base score is 5.3, indicating a medium severity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the syncapi /context endpoint to trusted users or networks if possible. Monitor vendor communications for updates regarding a patch or official remediation.