4.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45057

CVE-2026-45057: matrix-sdk-ui: Incomplete edit validation

Impact

The message edit validation logic in the matrix-sdk-ui crate before 0.16.1 is missing a check: when replacing an encrypted event, the replacement event itself is not required to be encrypted. This enables a malicious homeserver administrator (or an actor with equivalent power) to impersonate or spoof messages as if they were sent by a victim user.

Patches

matrix-sdk-ui 0.16.1 fixes the message edit validation logic to align with the algorithm for replacement events^1 described in the Matrix specification.

Workarounds

N/A

References

Pull request: https://github.com/matrix-org/matrix-rust-sdk/pull/6454

For more information

If you have any questions or comments about this advisory, please email us at security at matrix.org.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45057

CVE-2026-45057:

4.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
matrix-sdk-ui	rust	< 0.16.1	0.16.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the incomplete validation of message edits across the Matrix Rust SDK. Specifically, the SDK did not enforce a critical rule from the Matrix specification: if an original event (message) is encrypted, any replacement event (edit) must also be encrypted. This oversight allowed a malicious homeserver administrator to replace a user's encrypted message with a cleartext message of their choosing, effectively spoofing messages from that user.

The fix involved creating a new, centralized function, check_validity_of_replacement_events, which correctly implements all the specified validation rules for edits. This function was then integrated into all the code paths that process message edits.

I have identified three key areas where this vulnerability was present:

Timeline Aggregation (matrix-sdk-ui): The edit_item function, which is responsible for applying edits to messages in the user's timeline, lacked the necessary validation. This is the most direct manifestation of the vulnerability for an end-user viewing a timeline.
Latest Event Logic (matrix-sdk): The Builder::new_remote function, used to determine the most recent event in a room (often for previews), would incorrectly select an invalid edit as the latest event.
Thread Summaries (matrix-sdk): The logic for updating thread summaries also failed to validate edits on thread replies, allowing an invalid edit to be reflected as the latest message in a thread.

By patching these functions to use the new validation logic, the vulnerability was remediated throughout the SDK.

Vulnerable functions

matrix_sdk_ui::timeline::controller::aggregations::edit_item

crates/matrix-sdk-ui/src/timeline/controller/aggregations.rs

This function applies edits to timeline items. Before the patch, it did not validate whether a cleartext edit was being used to replace an encrypted message. This allowed a malicious server to spoof messages by replacing an encrypted event with a non-encrypted one.

matrix_sdk::latest_events::latest_event::builder::Builder::new_remote

crates/matrix-sdk/src/latest_events/latest_event/builder.rs

This function is responsible for determining the latest event in a room. It was vulnerable because it would accept an invalid edit (e.g., a cleartext edit of an encrypted message) as the latest event without proper validation. This could lead to message spoofing in contexts where only the latest event is displayed.

matrix_sdk::event_cache::caches::room::state::RoomEventCacheStateLockWriteGuard::maybe_update_thread_summary_from_new_events

crates/matrix-sdk/src/event_cache/caches/room/state.rs

This internal function updates thread summaries. The vulnerability existed here because it would use the latest edit for a thread reply without validating it. This could cause a thread summary to display a spoofed message if a malicious server provided an invalid edit (e.g., a cleartext edit for an encrypted reply).

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.