https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 20:31:39 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-45057 <p>matrix-sdk-ui provides GUI-centric utilities on top of matrix-rust-sdk. The message edit validation logic in the `matrix-sdk-ui` crate prior to 0.17.0 is missing a check: when replacing an encrypted event, the replacement event itself is not required to be encrypted. This enables a malicious homeserver administrators (or actors with equivalent power) to impersonate or spoof messages as if they were sent by a victim user. `matrix-sdk-ui` 0.17.0 fixes the message edit validation logic to align with the algorithm for replacement events[^1] described in the Matrix specification. No known workarounds are available.</p> <p>matrix-sdk-ui provides GUI-centric utilities on top of matrix-rust-sdk. The message edit validation logic in the `matrix-sdk-ui` crate prior to 0.17.0 is missing a check: when replacing an encrypted event, the replacement event itself is not required to be encrypted. This enables a malicious homeserver administrators (or actors with equivalent power) to impersonate or spoof messages as if they were sent by a victim user. `matrix-sdk-ui` 0.17.0 fixes the message edit validation logic to align with the algorithm for replacement events[^1] described in the Matrix specification. No known workarounds are available.</p> https://db.gcve.eu/vuln/fkie_cve-2026-45057 https://db.gcve.eu/vuln/ghsa-h97m-27fx-42rx <p><strong>Affected:</strong> crates.io: matrix-sdk-ui</p> <p>### Impact The message edit validation logic in the `matrix-sdk-ui` crate before 0.16.1 is missing a check: when replacing an encrypted event, the replacement event itself is not required to be encrypted. This enables a malicious homeserver administrator (or an actor with equivalent power) to impersonate or spoof messages as if they were sent by a victim user.</p> <p>### Patches `matrix-sdk-ui` 0.16.1 fixes the message edit validation logic to align with the algorithm for replacement events[^1] described in the Matrix specification.</p> <p>### Workarounds N/A</p> <p>### References * Pull request: https://github.com/matrix-org/matrix-rust-sdk/pull/6454</p> <p>### For more information If you have any questions or comments about this advisory, please email us at [security at matrix.org](mailto:security@matrix.org).</p> <p>[^1]: https://spec.matrix.org/unstable/client-server-api/#validity-of-replacement-events</p> <p><strong>Affected:</strong> crates.io: matrix-sdk-ui</p> <p>### Impact The message edit validation logic in the `matrix-sdk-ui` crate before 0.16.1 is missing a check: when replacing an encrypted event, the replacement event itself is not required to be encrypted. This enables a malicious homeserver administrator (or an actor with equivalent power) to impersonate or spoof messages as if they were sent by a victim user.</p> <p>### Patches `matrix-sdk-ui` 0.16.1 fixes the message edit validation logic to align with the algorithm for replacement events[^1] described in the Matrix specification.</p> <p>### Workarounds N/A</p> <p>### References * Pull request: https://github.com/matrix-org/matrix-rust-sdk/pull/6454</p> <p>### For more information If you have any questions or comments about this advisory, please email us at [security at matrix.org](mailto:security@matrix.org).</p> <p>[^1]: https://spec.matrix.org/unstable/client-server-api/#validity-of-replacement-events</p> https://db.gcve.eu/vuln/ghsa-h97m-27fx-42rx https://db.gcve.eu/vuln/rustsec-2026-0158 <p><strong>Affected:</strong> crates.io: matrix-sdk-ui</p> <p>The message edit validation logic in the matrix-sdk-ui crate before 0.16.1 is missing a check: when replacing an encrypted event, the replacement event itself is not required to be encrypted. This enables a malicious homeserver administrator (or an actor with equivalent power) to impersonate or spoof messages as if they were sent by a victim user.</p> <p><strong>Affected:</strong> crates.io: matrix-sdk-ui</p> <p>The message edit validation logic in the matrix-sdk-ui crate before 0.16.1 is missing a check: when replacing an encrypted event, the replacement event itself is not required to be encrypted. This enables a malicious homeserver administrator (or an actor with equivalent power) to impersonate or spoof messages as if they were sent by a victim user.</p> https://db.gcve.eu/vuln/rustsec-2026-0158