PT-2026-46306 · Unknown · Matrix-Sdk-Ui

Published 2026-06-03 · Updated 2026-06-04 · CVE-2026-45057

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions matrix-sdk-ui versions prior to 0.16.1

Description The message edit validation logic is missing a check when replacing an encrypted event, as the replacement event is not required to be encrypted. This allows a malicious homeserver administrator or an actor with similar privileges to impersonate or spoof messages as if they were sent by a victim user.

Recommendations Update to version 0.16.1.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2026-45057

GHSA-H97M-27FX-42RX

RUSTSEC-2026-0158

Affected Products

Matrix-Sdk-Ui

References · 8

• https://osv.dev/vulnerability/GHSA-h97m-27fx-42rx · Vendor Advisory
• https://osv.dev/vulnerability/RUSTSEC-2026-0158 · Vendor Advisory
• https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-h97m-27fx-42rx · Note
• https://github.com/matrix-org/matrix-rust-sdk · Note
• https://github.com/matrix-org/matrix-rust-sdk/releases/tag/matrix-sdk-0.16.1 · Note
• https://github.com/matrix-org/matrix-rust-sdk/pull/6454 · Note
• https://crates.io/crates/matrix-sdk-ui · Note
• https://rustsec.org/advisories/RUSTSEC-2026-0158.html · Note