-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems directly from the UserIdentity::is_verified implementation shown in the commit diff. The original code (line 230) only checked if the own identity signed the target identity (o.is_identity_signed(&self.inner)), while the patched version (lines 233-234) adds the critical own_identity.is_verified() check. This matches the advisory's description that the method didn't consider the verification status of the user's own identity, making it the clear vulnerable function. The high confidence comes from direct correlation between the vulnerability description, CWE-287/863 classifications, and the specific code changes shown in the commit.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| matrix-sdk-crypto | rust | < 0.7.2 | 0.7.2 |