CVE-2026-45057

Katalog CVE

CVSS 4.9 · Medium EPSS 0,23%

Kerentanan Insufficient Verification of Data Authenticity. Skor CVSS 3.1 4.9 (Medium) menurut github.com.

Deskripsi (NVD)

matrix-sdk-ui provides GUI-centric utilities on top of matrix-rust-sdk. The message edit validation logic in the `matrix-sdk-ui` crate prior to 0.17.0 is missing a check: when replacing an encrypted event, the replacement event itself is not required to be encrypted. This enables a malicious homeserver administrators (or actors with equivalent power) to impersonate or spoof messages as if they were sent by a victim user. `matrix-sdk-ui` 0.17.0 fixes the message edit validation logic to align with the algorithm for replacement events[^1] described in the Matrix specification. No known workarounds are available.

Rincian

Terbit di NVD

11 September 2026

Terakhir diubah

30 September 2026

Status NVD

Deferred

CVSS 3.1

4.9 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-345: Insufficient Verification of Data Authenticity

EPSS (30 hari)

0,23% peluang dieksploitasi; lebih tinggi dari 13,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/matrix-org/matrix-rust-sdk/pull/6454
• https://github.com/matrix-org/matrix-rust-sdk/releases/tag/matrix-sdk-0.16.1
• https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-h97m-27fx-42rx
• https://rustsec.org/advisories/RUSTSEC-2026-0158.html