{"id":"CVE-2023-38700","aliases":["GHSA-c7hh-3v6c-fj4q"],"url":"https://o3.security/vulnerability/CVE-2023-38700","summary":"matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms","details":"### Impact\n\nIt was possible to craft an event such that it would leak part of a targeted message event from another bridged room. This required knowing an event ID to target.\n\n### Patches\n\nPlease upgrade to 1.0.1.\n\n### Workarounds\n\nYou can set the `matrixHandler.eventCacheSize` config value to `0` to workaround this bug. However, this may impact performance.\n\n### Credits\n\nDiscovered and reported by [Val Lorentz](https://valentin-lorentz.fr/).\n\n### For more information\n\nIf you have any questions or comments about this advisory email us at [security@matrix.org](mailto:security@matrix.org).","published":"2023-08-04T18:05:43.187Z","modified":"2026-08-12T03:51:27.944655386Z","cvss":{"score":3.5,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N"},"epss":{"score":0.00599,"percentile":0.45929,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"matrix-appservice-irc","fixedVersion":"1.0.1"}],"fix":{"url":"https://github.com/matrix-org/matrix-appservice-irc/commit/8bbd2b69a16cbcbeffdd9b5c973fd89d61498d75","label":"matrix-org/matrix-appservice-irc@8bbd2b6"},"references":[{"type":"WEB","url":"https://github.com/matrix-org/matrix-appservice-irc/releases/tag/1.0.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38700.json"},{"type":"ADVISORY","url":"https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-c7hh-3v6c-fj4q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38700"},{"type":"FIX","url":"https://github.com/matrix-org/matrix-appservice-irc/commit/8bbd2b69a16cbcbeffdd9b5c973fd89d61498d75"},{"type":"PACKAGE","url":"https://github.com/matrix-org/matrix-appservice-irc"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:27.944655386Z"}}