{"id":"RUSTSEC-2026-0158","revision":"19917b627170465a9c6b810270b9b2b3","records":[{"revision":"19917b627170465a9c6b810270b9b2b3","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2026-0158","aliases":["CVE-2026-45057","GHSA-h97m-27fx-42rx"],"title":"Incomplete message edit validation in matrix-sdk-ui","description":"The message edit validation logic in the matrix-sdk-ui crate before 0.16.1 is\nmissing a check: when replacing an encrypted event, the replacement event itself\nis not required to be encrypted. This enables a malicious homeserver\nadministrator (or an actor with equivalent power) to impersonate or spoof\nmessages as if they were sent by a victim user.","state":0,"publishedAt":"2026-06-03T12:00:00+00:00","modifiedAt":"2026-10-12T18:00:14.30085+00:00","affected":[{"ecosystem":"crates.io","name":"matrix-sdk-ui","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.0.0-0"},{"kind":"fixed","version":"0.16.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","score":null,"severity":null}],"references":["https://crates.io/crates/matrix-sdk-ui","https://rustsec.org/advisories/RUSTSEC-2026-0158.html","https://github.com/matrix-org/matrix-rust-sdk/pull/6454"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0158","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2026-0158","identifiers":["RUSTSEC-2026-0158","CVE-2026-45057","GHSA-h97m-27fx-42rx"]},"retained":false,"historicalAffected":[]}],"coverage":[]}