{"action":"Upgrade matrix-appservice-bridge to 2.6.1 or later.","affected":[{"fixed":"2.6.1","introduced":"0"}],"component":"matrix-appservice-bridge","cve_ids":["CVE-2021-32659"],"ecosystem":"npm","epss":0.00936,"exploited":false,"fixed_versions":["2.6.1"],"ghsa_id":"GHSA-35g4-qx3c-vjhx","id":"tcs_01M5KEW1EF0DFRKR990SJ3W1SR","modified_at":"2026-07-08T06:29:05.568084068Z","published_at":"2021-06-21T17:09:22Z","references":["https://osv.dev/vulnerability/GHSA-35g4-qx3c-vjhx","https://github.com/matrix-org/matrix-appservice-bridge/security/advisories/GHSA-35g4-qx3c-vjhx","https://nvd.nist.gov/vuln/detail/CVE-2021-32659","https://github.com/matrix-org/matrix-appservice-bridge/pull/330","https://github.com/matrix-org/matrix-appservice-bridge/commit/b69e745584a34fcfd858df33e4631e420da07b9f","https://github.com/matrix-org/matrix-appservice-bridge/releases/tag/2.6.1"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-35g4-qx3c-vjhx","url":"https://osv.dev/vulnerability/GHSA-35g4-qx3c-vjhx"}],"summary":"Automatic room upgrade handling can be used maliciously to bridge a room non-consentually"}