{"id":"EUVD-2026-76764","enisaUuid":"295511a0-7605-3b92-a38e-1f72a63ef4be","description":"matrix-sdk-ui provides GUI-centric utilities on top of matrix-rust-sdk. The message edit validation logic in the  `matrix-sdk-ui` crate prior to 0.17.0 is missing a check: when replacing an encrypted event, the replacement event itself is not required to be encrypted. This enables a malicious homeserver administrators (or actors with equivalent power) to impersonate or spoof messages as if they were sent by a victim user. `matrix-sdk-ui` 0.17.0 fixes the message edit validation logic to align with the algorithm for replacement events[^1] described in the Matrix specification. No known workarounds are available.","datePublished":"Sep 11, 2026, 9:12:17 PM","dateUpdated":"Sep 14, 2026, 4:18:19 PM","baseScore":4.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","references":"https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-h97m-27fx-42rx\nhttps://github.com/matrix-org/matrix-rust-sdk/pull/6454\nhttps://github.com/matrix-org/matrix-rust-sdk/releases/tag/matrix-sdk-0.16.1\nhttps://rustsec.org/advisories/RUSTSEC-2026-0158.html\n","aliases":"CVE-2026-45057\nGHSA-h97m-27fx-42rx\n","assigner":"GitHub_M","epss":0.23,"enisaIdProduct":[{"id":"59416741-5a72-361d-9a93-eb5c5185ea50","product":{"name":"matrix-sdk-ui","vendor":{"name":"matrix-org"}},"product_version":"\u003c 0.16.1"}],"enisaIdVendor":[{"id":"a37b2f4a-1565-3630-8a99-410afdde04a8","vendor":{"name":"matrix-org"}}],"enisaIdVulnerability":[{"id":"448f311c-4141-3259-9020-2245c31f5160","vulnerability":{"id":"CVE-2026-45057","description":"matrix-sdk-ui provides GUI-centric utilities on top of matrix-rust-sdk. The message edit validation logic in the  `matrix-sdk-ui` crate prior to 0.17.0 is missing a check: when replacing an encrypted event, the replacement event itself is not required to be encrypted. This enables a malicious homeserver administrators (or actors with equivalent power) to impersonate or spoof messages as if they were sent by a victim user. `matrix-sdk-ui` 0.17.0 fixes the message edit validation logic to align with the algorithm for replacement events[^1] described in the Matrix specification. No known workarounds are available.","datePublished":"Sep 11, 2026, 9:12:17 PM","dateUpdated":"Sep 14, 2026, 4:18:19 PM","status":"PUBLISHED","baseScore":4.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","references":"https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-h97m-27fx-42rx\nhttps://github.com/matrix-org/matrix-rust-sdk/pull/6454\nhttps://github.com/matrix-org/matrix-rust-sdk/releases/tag/matrix-sdk-0.16.1\nhttps://rustsec.org/advisories/RUSTSEC-2026-0158.html\n","enisa_id":"EUVD-2026-76764\n","assigner":"GitHub_M","epss":0.23,"dataProcessed":"Oct 30, 2026, 7:17:41 AM","vulnerabilityProduct":[{"id":"9fa34995-29da-3e2b-ab95-093893f62a82","product":{"name":"matrix-sdk-ui","vendor":{"name":"matrix-org"}},"product_version":"\u003c 0.16.1"}],"vulnerabilityVendor":[{"id":"61f746c8-6842-3bd1-9320-999c86acc582","vendor":{"name":"matrix-org"}}]}},{"id":"e973b994-de95-3919-b66d-5bc51ffc8bc3","vulnerability":{"id":"GHSA-h97m-27fx-42rx","description":"matrix-sdk-ui: Incomplete edit validation","datePublished":"Jun 4, 2026, 2:50:47 PM","dateUpdated":"Jun 4, 2026, 2:50:47 PM","baseScore":0.0,"references":"https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-h97m-27fx-42rx\nhttps://github.com/matrix-org/matrix-rust-sdk/pull/6454\nhttps://github.com/matrix-org/matrix-rust-sdk\nhttps://github.com/matrix-org/matrix-rust-sdk/releases/tag/matrix-sdk-0.16.1\nhttps://rustsec.org/advisories/RUSTSEC-2026-0158.html\n","enisa_id":"EUVD-2026-76764\n","aliases":"GHSA-h97m-27fx-42rx\nCVE-2026-45057\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:56:29 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}