Vulnerability · Published Jul 17, 2026 · Assigned by VulnCheck

CVE-2026-63095Dendrite 0.13.8 Improper Authorization via POST account/3pid/delete Endpoint

Medium 6.5

In plain English

A medium-severity authorization bypass via user-controlled key in dendrite from matrix-org. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 77.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Dendrite through 0.13.8 contains an improper authorization vulnerability in the Matrix Client-Server API that allows any authenticated local user to delete third-party identifier bindings belonging to other users by submitting an arbitrary address and medium to the account deletion endpoint without ownership verification. Attackers can exploit the unverified Forget3PID handler to remove a victim's email or MSISDN binding and subsequently rebind the address through an identity server to hijack the victim's password reset flow.

Affected products (as reported)

Vendor	Product	Versions
matrix-org	dendrite	0 – through 0.13.8

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

Researcher Disclosure technical-description, exploit
https://www.vulncheck.com/advisories/dendrite-improper-authorization-via-post-account-3pid-delete-endpoint third-party-advisory