chore: Release

Reviewed-By: timedout <git@nexy7574.co.uk>
Reviewed-By: Ginger <ginger@gingershaped.computer>

CHANGELOG.md

@@ -1,3 +1,11 @@
+# Continuwuity 26.7.3 (2026-08-11)
+
+## Bugfixes
+
+- Fixed a vulnerability that enabled the server to leak certain events over federation. Contributed by @eleboucher. (SEC26)
+- Fixed an issue that allowed an attacker to take over another account on the same server under certain conditions. ([GHSA-v2x6-m99h-vqxx](https://github.com/continuwuity/continuwuity/security/advisories/GHSA-v2x6-m99h-vqxx)) Contributed by @gingershaped and reported by GlitchedAxiom. (SEC28)
+
+
 # Continuwuity 26.7.0 (2026-07-27)
 
 ## Features

Cargo.lock

@@ -816,7 +816,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit"
-version = "26.7.2"
+version = "26.7.3"
 dependencies = [
  "aws-lc-rs",
  "clap",
@@ -854,7 +854,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_admin"
-version = "26.7.2"
+version = "26.7.3"
 dependencies = [
  "assign",
  "clap",
@@ -880,7 +880,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_api"
-version = "26.7.2"
+version = "26.7.3"
 dependencies = [
  "assign",
  "async-trait",
@@ -918,7 +918,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_build_metadata"
-version = "26.7.2"
+version = "26.7.3"
 dependencies = [
  "built",
  "cargo_metadata",
@@ -926,7 +926,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_core"
-version = "26.7.2"
+version = "26.7.3"
 dependencies = [
  "argon2",
  "arrayvec",
@@ -994,7 +994,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_database"
-version = "26.7.2"
+version = "26.7.3"
 dependencies = [
  "async-channel",
  "conduwuit_core",
@@ -1015,7 +1015,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_macros"
-version = "26.7.2"
+version = "26.7.3"
 dependencies = [
  "cargo_toml",
  "itertools 0.15.0",
@@ -1026,7 +1026,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_router"
-version = "26.7.2"
+version = "26.7.3"
 dependencies = [
  "assign",
  "axum",
@@ -1063,7 +1063,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_service"
-version = "26.7.2"
+version = "26.7.3"
 dependencies = [
  "askama",
  "assign",
@@ -1115,7 +1115,7 @@ dependencies = [
 
 [[package]]
 name = "conduwuit_web"
-version = "26.7.2"
+version = "26.7.3"
 dependencies = [
  "askama",
  "assign",
@@ -4765,7 +4765,7 @@ dependencies = [
 
 [[package]]
 name = "ruminuwuity"
-version = "26.7.2"
+version = "26.7.3"
 dependencies = [
  "assign",
  "ruma",
@@ -6874,7 +6874,7 @@ dependencies = [
 
 [[package]]
 name = "xtask"
-version = "26.7.2"
+version = "26.7.3"
 dependencies = [
  "askama",
  "cargo_metadata",

Cargo.toml

@@ -12,7 +12,7 @@ license = "Apache-2.0"
 # See also `rust-toolchain.toml`
 readme = "README.md"
 repository = "https://forgejo.ellis.link/continuwuation/continuwuity"
-version = "26.7.2"
+version = "26.7.3"
 
 [workspace.metadata.crane]
 name = "conduwuit"

changelog.d/sec10.bugfix.md

@@ -1 +0,0 @@
-**TODO - embargoed until next release** (maintainers see security issue 10 when writing rls notes). Contributed by @eleboucher.

src/api/server/event_auth.rs

@@ -1,9 +1,9 @@
 use std::{borrow::Borrow, iter::once};
 
 use axum::extract::State;
-use conduwuit::{Err, Error, Result, err, info, utils::stream::ReadyExt};
+use conduwuit::{Err, Event, Result, info, utils::stream::ReadyExt};
 use futures::StreamExt;
-use ruma::{RoomId, api::federation::authorization::get_event_authorization};
+use ruma::api::federation::authorization::get_event_authorization;
 
 use super::AccessCheck;
 use crate::Ruma;
@@ -48,25 +48,21 @@ pub(crate) async fn get_event_authorization_route(
 		return Err!(Request(NotFound("This server is not participating in that room.")));
 	}
 
-	let event = services
+	// The event must be in the room we just authorised access to
+	if !services
 		.rooms
 		.timeline
-		.get_pdu_json(&body.event_id)
+		.get_pdu(&body.event_id)
 		.await
-		.map_err(|_| err!(Request(NotFound("Event not found."))))?;
-
-	let room_id_str = event
-		.get("room_id")
-		.and_then(|val| val.as_str())
-		.ok_or_else(|| Error::bad_database("Invalid event in database."))?;
-
-	let room_id = <&RoomId>::try_from(room_id_str)
-		.map_err(|_| Error::bad_database("Invalid room_id in event in database."))?;
+		.is_ok_and(|pdu| pdu.room_id_or_hash() == body.room_id)
+	{
+		return Err!(Request(NotFound("Event not found.")));
+	}
 
 	let auth_chain = services
 		.rooms
 		.auth_chain
-		.event_ids_iter(room_id, once(body.event_id.borrow()))
+		.event_ids_iter(&body.room_id, once(body.event_id.borrow()))
 		.ready_filter_map(Result::ok)
 		.filter_map(|id| async move { services.rooms.timeline.get_pdu_json(&id).await.ok() })
 		.then(|pdu| services.sending.convert_to_outgoing_federation_event(pdu))

src/api/server/state.rs

@@ -1,7 +1,7 @@
 use std::{borrow::Borrow, iter::once};
 
 use axum::extract::State;
-use conduwuit::{Err, Result, at, err, info, utils::IterStream};
+use conduwuit::{Err, Event, Result, at, err, info, utils::IterStream};
 use futures::{FutureExt, StreamExt, TryStreamExt};
 use ruma::{OwnedEventId, api::federation::event::get_room_state};
 
@@ -24,6 +24,17 @@ pub(crate) async fn get_room_state_route(
 	.assert()
 	.await?;
 
+	// The event must be in the room we just authorised access to
+	if !services
+		.rooms
+		.timeline
+		.get_pdu(&body.event_id)
+		.await
+		.is_ok_and(|pdu| pdu.room_id_or_hash() == body.room_id)
+	{
+		return Err!(Request(NotFound("Event not found.")));
+	}
+
 	if services
 		.rooms
 		.pdu_metadata

src/api/server/state_ids.rs

@@ -1,7 +1,7 @@
 use std::{borrow::Borrow, iter::once};
 
 use axum::extract::State;
-use conduwuit::{Err, Result, at, err, info};
+use conduwuit::{Err, Event, Result, at, err, info};
 use futures::{StreamExt, TryStreamExt};
 use ruma::{OwnedEventId, api::federation::event::get_room_state_ids};
 
@@ -25,6 +25,17 @@ pub(crate) async fn get_room_state_ids_route(
 	.assert()
 	.await?;
 
+	// The event must be in the room we just authorised access to
+	if !services
+		.rooms
+		.timeline
+		.get_pdu(&body.event_id)
+		.await
+		.is_ok_and(|pdu| pdu.room_id_or_hash() == body.room_id)
+	{
+		return Err!(Request(NotFound("Event not found.")));
+	}
+
 	if services
 		.rooms
 		.pdu_metadata

src/service/threepid/mod.rs

@@ -127,6 +127,10 @@ pub async fn send_validation_email<Template: MessageTemplate>(
 			// If a validation session already exists for this client secret, we can either
 			// reuse it with a new token or return early because it's already valid.
 			| Some(session) => {
+				if session.email != recipient.email {
+					return Err!(Request(InvalidParam("Wrong email for session.")));
+				}
+
 				match session.validation_state {
 					| ValidationState::Validated => {
 						// If the existing session is already valid, don't send an email.
@@ -134,7 +138,7 @@ pub async fn send_validation_email<Template: MessageTemplate>(
 					},
 					| ValidationState::Pending(ref mut token) => {
 						// Check ratelimiting for the target address.
-						if self.ratelimiter.check_key(&recipient.email).is_err() {
+						if self.ratelimiter.check_key(&session.email).is_err() {
 							return Err(Error::BadRequest(
 								ErrorKind::LimitExceeded(LimitExceededErrorData::new()),
 								"You're sending emails too fast, try again in a few minutes.",