GHSA-h97m-27fx-42rx

Source

https://github.com/advisories/GHSA-h97m-27fx-42rx

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-h97m-27fx-42rx/GHSA-h97m-27fx-42rx.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-h97m-27fx-42rx

Aliases

Published

2026-06-04T14:50:47Z

Modified

2026-06-04T15:00:08Z

Severity

4.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

matrix-sdk-ui: Incomplete edit validation

Details

Impact

The message edit validation logic in the matrix-sdk-ui crate before 0.16.1 is missing a check: when replacing an encrypted event, the replacement event itself is not required to be encrypted. This enables a malicious homeserver administrator (or an actor with equivalent power) to impersonate or spoof messages as if they were sent by a victim user.

Patches

matrix-sdk-ui 0.16.1 fixes the message edit validation logic to align with the algorithm for replacement events^1 described in the Matrix specification.

Workarounds

N/A

References

Pull request: https://github.com/matrix-org/matrix-rust-sdk/pull/6454

For more information

If you have any questions or comments about this advisory, please email us at security at matrix.org.

Database specific

{
    "cwe_ids": [
        "CWE-345"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-04T14:50:47Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}

References

Affected packages

crates.io / matrix-sdk-ui

Package

Name: matrix-sdk-ui; View open source insights on deps.dev
Purl: pkg:cargo/matrix-sdk-ui

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.16.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-h97m-27fx-42rx/GHSA-h97m-27fx-42rx.json"