Bot adds homeserver users to private ticket

[amberhawker]

When a user in Discord creates a ticket and the guild is bridged, all homeserver users who have authenticated with Discord are added to the ticket room.

I'm using the dock.mau.dev/mautrix/discord:latest docker image. I'm not sure what version, but I've made sure to "pull" as of 5/29/2025, so it should be up to date.

I have a few users that are both within my Discord server, and have signed into the mautrix-discord bridge with their Discord accounts. It's double puppetted and all that too. When any user creates a ticket in my server via the Ticket Tool#4843 bot, all matrix users that are logged into Discord are added to that ticket. They're able to send messages, but those messages are not bridged. The big concern is that these tickets can be sensitive, and all matrix users can see the whole ticket history.

I'm pretty sure these are the logs, but let me know if you need more. It's extremely consistent for me.

2025-05-29T17:04:50Z DBG Updating portal topic channel_id=1377694176816271545 channel_receiver= new_topic= old_topic= room_id=!MAdBVCWLsIWfZpw705:basil.quest
2025-05-29T17:04:51Z DBG Request completed as_user_id=@discordbot:basil.quest duration=342.094005 method=PUT req_body={"fi.mau.will_auto_accept":true,"membership":"invite"} req_id=874 response_length=59 response_mime=application/json status_code=200 url=http://host.docker.internal:8008/_matrix/client/v3/rooms/%21MAdBVCWLsIWfZpw705:basil.quest/state/m.room.member/@trevshit:basil.quest?user_id=%40discordbot%3Abasil.quest
2025-05-29T17:04:51Z DBG Starting handling of transaction content={"pdu":1} transaction_id=MZLo6itm5vqjUm7kmF3q5kbZpHB6PwfrST6nckvPyQo
2025-05-29T17:04:51Z DBG Finished dispatching events from transaction transaction_id=MZLo6itm5vqjUm7kmF3q5kbZpHB6PwfrST6nckvPyQo
2025-05-29T17:04:51Z DBG Request completed as_user_id=@discordbot:basil.quest duration=348.159346 method=PUT req_body={"fi.mau.will_auto_accept":true,"membership":"invite"} req_id=875 response_length=59 response_mime=application/json status_code=200 url=http://host.docker.internal:8008/_matrix/client/v3/rooms/%21MAdBVCWLsIWfZpw705:basil.quest/state/m.room.member/@scuglet:basil.quest?user_id=%40discordbot%3Abasil.quest
2025-05-29T17:04:51Z DBG Starting handling of transaction content={"pdu":1} transaction_id=sUMDvbYXcBI2DtrCc7hUGIgO-2yHuNkvrC9yK_Cs6dE
2025-05-29T17:04:51Z DBG Finished dispatching events from transaction transaction_id=sUMDvbYXcBI2DtrCc7hUGIgO-2yHuNkvrC9yK_Cs6dE
2025-05-29T17:04:51Z DBG Request completed as_user_id=@discordbot:basil.quest duration=352.717142 method=PUT req_body={"fi.mau.will_auto_accept":true,"membership":"invite"} req_id=876 response_length=59 response_mime=application/json status_code=200 url=http://host.docker.internal:8008/_matrix/client/v3/rooms/%21MAdBVCWLsIWfZpw705:basil.quest/state/m.room.member/@butr:basil.quest?user_id=%40discordbot%3Abasil.quest
2025-05-29T17:04:51Z DBG Starting handling of transaction content={"pdu":1} transaction_id=XYLatKjTQ5PD7KiAtEB4rWInehzfW8A9ktJ8CcIAiZs
2025-05-29T17:04:51Z DBG Finished dispatching events from transaction transaction_id=XYLatKjTQ5PD7KiAtEB4rWInehzfW8A9ktJ8CcIAiZs
2025-05-29T17:04:51Z DBG Request completed as_user_id=@discordbot:basil.quest duration=361.557733 method=PUT req_body={"fi.mau.will_auto_accept":true,"membership":"invite"} req_id=877 response_length=59 response_mime=application/json status_code=200 url=http://host.docker.internal:8008/_matrix/client/v3/rooms/%21MAdBVCWLsIWfZpw705:basil.quest/state/m.room.member/@relayhost:basil.quest?user_id=%40discordbot%3Abasil.quest

If someone wants the steps to reproduce

1. Setup the mautrix-discord bridge, enabling double-puppetting.
2. Authenticate with Discord on your main account
3. Run guilds bridge <guildid>
4. Create another matrix user.
5. Authenticate that user with a Discord account which is in the same guild as bridged above
6. Create a ticket using the Ticket Tool#4843 bot.
7. Check matrix, and notice how not only you, but the other user has been invited

Anyways hope this all helps. Please let me know if you need more info and I will be GLAD to explain more. Thank you for all your help. I hope we can figure this out, since it is quite a privacy issue for people who create tickets in order to seek help for any sort of issues.

Thank you :)