A flaw in sydent’s validation of email addresses can lead to a failure to correctly limit registration to a given email domain. This only affects people who are relying on allowed_local_3pid in their synapse config. If you have been relying on this option to restrict access to your homeserver’s user_threepids table for malformed email addresses, you may wish to check your.ervers user_Threepid table for. malformed. email addresses and your database as follows: $ sqlite3.db.”]
Source: https://matrix.org/blog/2019/04/18/security-update-sydent-1-0-2/