We just pushed Synapse 0.19.2, which contains a single but important fix for protecting event visibility when accessed via the /context API. Please upgrade from https://github.com/matrix-org/synapse! Changes in synapse v0.19.2 (2017-02-20) Fix bug with event visibility check in /context/ API. Thanks to Tokodomo for pointing it out! (PR #1929)