Impact For some client-issued requests concerning remote users or remote rooms belonging to a malicious homeserver, Synapse will make federation requests to that malicious homeserver and will forward received errors back to the client. This allows the malicious homeserver to cause the requesting client to act as though it has logged out and destroy its cryptographic state. If the user does not have another client available, does not have Online Key Backup, does not have a dehydrated device and does not have a manual backup copy of their session keys, they will irreversibly lose encrypted message history. The same issue can occur when a user sends a message in a room moderated by a malicious policy server. Homeservers that do not federate or only participate in a closed, trusted federation are not affected. ### Patches Update to Synapse 1.157.2 or later. See the table below for patched versions of "Element Server Suite" (https://element.io/en/server-suite), including Long-Term Support (LTS) versions. | | 25.10 LTS | 26.4 LTS | Latest | |:--|--|--|--| | ESS Pro | "25.10.14+lts" | "26.4.9+lts" | "26.7.2" | | ESS Classic | "25.10.09-gui" | "26.04.04-gui" | ⸻ | | ESS Community | ⸻ | ⸻ | "26.7.2" | | ESS TI-Messenger | "25.10.10" | "26.4.5" | "26.7.0" | ### Workarounds None known. ### Identifiers - ELEMENTSEC-2026-1721 ### For more information If you have any questions or comments about this advisory, please email us at "security at element.io" (mailto:security@element.io).