@soatok You could write all the details in an email to cert-fr@ssi.gouv.fr, it's a french government agency with a specific vulnerability disclosure program. It's opened to all kind of vulnerability, the only restriction is that the affected entity must be french. Since Tchap, the french instant-messaging platform for government workers, is based on Matrix, it's likely to be affected.

If you write to them in good faith, they will handle everything after and keep you anonymous so the affected people cannot go after you. People may not react when an individual contact them about a security issue, but when it's a government agency the answer is different.

Related links (in french):
https://cyber.gouv.fr/reglementation/cybersecurite-systemes-dinformation/declaration-de-vulnerabilit%C3%A9s/
https://www.cert.ssi.gouv.fr/signalements/