Synapse allows a a malformed invite to break the invitee's `/sync`

Vulnerability

Description Synapse, an open-source Matrix homeserver, versions prior to 1.120.1 do not properly validate invites received over federation [1]. This flaw enables a malicious server to send a specially crafted invite that disrupts the invited user's /sync endpoint, preventing the user from synchronizing their Matrix state.

Exploitation

An attacker must control a federated Matrix server and send a crafted invite to a target user on another server. No authentication is required beyond the ability to federate, and the attack does not require user interaction—the invite alone triggers the disruption. The attack surface is the federation API, typically exposed to the internet.

Impact

Successful exploitation causes the invited user's /sync to malfunction, effectively breaking the client's ability to receive new messages or room updates. This can lead to denial of service for the affected user, preventing them from using Matrix normally until the malformed invite is removed or the server is upgraded [3].

Mitigation

Synapse 1.120.1 rejects such invalid invites received over federation, restoring sync functionality for affected users [3]. Server administrators are advised to upgrade to this version or later. As a workaround, administrators can disable federation from untrusted servers, though this may limit interoperability [3].