GHSA-3x4c-pq33-4w3q

### Impact
Unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with `shared` history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room.

### Patches
Server administrators should upgrade to 1.41.1 or later.

### Workarounds
Administrators of servers that use a reverse proxy could, with potentially unacceptable loss of functionality, block the following endpoints:
* `/_matrix/client/r0/rooms/{room_id}/members` with `at` query parameter
* `/_matrix/client/unstable/rooms/{room_id}/members` with `at` query parameter

### References
n/a

### For more information
If you have any questions or comments about this advisory, e-mail us at [email protected].