Vulnerability RUSTSEC-2026-0158
Medium Risk
MEDIUM RISK
CVSS Score: 4.9
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
4 months ago
June 03, 2026 at 12:00 PM UTC
Incomplete message edit validation in matrix-sdk-ui
0.7.0 - 0.16.0
0.7.0 - 0.16.0
Summary
Incomplete message edit validation in matrix-sdk-ui
Details
The message edit validation logic in the matrix-sdk-ui crate before 0.16.1 is missing a check: when replacing an encrypted event, the replacement event itself is not required to be encrypted. This enables a malicious homeserver administrator (or an actor with equivalent power) to impersonate or spoof messages as if they were sent by a victim user.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Impacted packages
Timeline
Published
4 months ago
June 03, 2026 at 12:00 PM UTC
Fixed (0.16.1)
5 months ago
May 08, 2026 at 02:03 PM UTC
Last Modified
1 hour ago
October 12, 2026 at 06:00 PM UTC