CVE-2026-45057

Received Received - Intake

Message Spoofing in Matrix SDK UI

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: GitHub, Inc.

Description

matrix-sdk-ui provides GUI-centric utilities on top of matrix-rust-sdk. The message edit validation logic in the `matrix-sdk-ui` crate prior to 0.17.0 is missing a check: when replacing an encrypted event, the replacement event itself is not required to be encrypted. This enables a malicious homeserver administrators (or actors with equivalent power) to impersonate or spoof messages as if they were sent by a victim user. `matrix-sdk-ui` 0.17.0 fixes the message edit validation logic to align with the algorithm for replacement events[^1] described in the Matrix specification. No known workarounds are available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-45057

Affected Vendors & Products

Vendor	Product	Version / Range
matrix	matrix-sdk-ui	to 0.17.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

The vulnerability in matrix-sdk-ui before version 0.17.0 allows a malicious homeserver administrator or equivalent actor to spoof messages by replacing an encrypted event with an unencrypted one. The edit validation logic fails to check if the replacement event is encrypted, enabling impersonation of other users.

Detection Guidance

Detection requires inspecting Matrix message edit events for encryption status. Check if edited messages in encrypted rooms are not encrypted themselves. Review logs for events where the replacement event lacks encryption while the original was encrypted. No specific commands are provided in the context.

Impact Analysis

This vulnerability could allow attackers to impersonate you in encrypted chats, potentially tricking others into sharing sensitive information or believing false messages. It undermines trust in message authenticity and could lead to misinformation or fraud.

Compliance Impact

This vulnerability allows malicious homeserver administrators to impersonate or spoof messages from a victim user by bypassing encryption checks during message edits. This could lead to unauthorized data manipulation or misrepresentation, potentially violating integrity and authenticity requirements in compliance standards like GDPR (data integrity) and HIPAA (secure communication and data integrity).

Mitigation Strategies

Update matrix-sdk-ui to version 0.17.0 or later to fix the message edit validation logic. Ensure all users and administrators are aware of the update. Monitor for suspicious message edits where replacement events are unencrypted.

Hi! I’m here to help you understand CVE-2026-45057. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70