CyberRota Analysis
AI-GeneratedThe `matrix-sdk-ui` prior to version 0.17.0 is vulnerable due to inadequate validation of message edits, allowing malicious homeserver administrators to replace encrypted messages with unencrypted ones, potentially impersonating users. This could lead to significant trust and security issues within the messaging environment. Organizations using this SDK should prioritize upgrading to version 0.17.0 to mitigate the risk of message spoofing.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
matrix-sdk-ui provides GUI-centric utilities on top of matrix-rust-sdk. The message edit validation logic in the `matrix-sdk-ui` crate prior to 0.17.0 is missing a check: when replacing an encrypted event, the replacement event itself is not required to be encrypted. This enables a malicious homeserver administrators (or actors with equivalent power) to impersonate or spoof messages as if they were sent by a victim user. `matrix-sdk-ui` 0.17.0 fixes the message edit validation logic to align with the algorithm for replacement events[^1] described in the Matrix specification. No known workarounds are available.