-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing authorization checks during group call setup. The SDK accepted incoming direct calls even when the caller hadn't declared participation via m.call.member events. Functions responsible for handling incoming call invites (e.g., handleIncomingCall, onCallInvite) would be the logical points where this check was omitted. The CWE-862 (Missing Authorization) aligns with this scenario, and the patched version (24.1.0) likely added participant validation in these functions.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| matrix-js-sdk | npm | < 24.1.0 | 24.1.0 |
JavaScriptJavaScriptOngoing coverage of React2Shell