{"id":"CVE-2026-45057","summary":"matrix-sdk-ui: Incomplete edit validation","details":"matrix-sdk-ui provides GUI-centric utilities on top of matrix-rust-sdk. The message edit validation logic in the  `matrix-sdk-ui` crate prior to 0.17.0 is missing a check: when replacing an encrypted event, the replacement event itself is not required to be encrypted. This enables a malicious homeserver administrators (or actors with equivalent power) to impersonate or spoof messages as if they were sent by a victim user. `matrix-sdk-ui` 0.17.0 fixes the message edit validation logic to align with the algorithm for replacement events[^1] described in the Matrix specification. No known workarounds are available.","aliases":["GHSA-h97m-27fx-42rx","RUSTSEC-2026-0158"],"modified":"2026-11-04T02:47:34.995499670Z","published":"2026-09-11T21:12:17.797Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45057.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-345"]},"references":[{"type":"WEB","url":"https://github.com/matrix-org/matrix-rust-sdk/releases/tag/matrix-sdk-0.16.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45057.json"},{"type":"ADVISORY","url":"https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-h97m-27fx-42rx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45057"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0158.html"},{"type":"FIX","url":"https://github.com/matrix-org/matrix-rust-sdk/pull/6454"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/matrix-org/matrix-rust-sdk","events":[{"introduced":"0"},{"fixed":"5fae3ff34ed17f1f416803d0de49ba1ed326f175"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"fixed":"0.16.1"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"source":"REFERENCES_TAG","original_tag":"matrix-sdk-0.16.1","range":[{"fixed":"5fae3ff34ed17f1f416803d0de49ba1ed326f175"}]}]}}],"versions":["ruma-appservice-api-0.8.1","ruma-common-0.11.3","ruma-common-0.11.2","ruma-common-0.11.1","ruma-0.8.1","ruma-0.8.0","ruma-client-0.11.0","ruma-state-res-0.9.0","ruma-signatures-0.13.0","ruma-server-util-0.1.0","ruma-push-gateway-api-0.7.0","ruma-identity-service-api-0.7.0","ruma-federation-api-0.7.0","ruma-client-api-0.16.0","ruma-appservice-api-0.8.0","ruma-common-0.11.0","ruma-0.7.3","ruma-common-0.10.3","ruma-0.7.2","ruma-common-0.10.2","ruma-0.7.1","ruma-common-0.10.1","ruma-0.7.0","ruma-state-res-0.8.0","ruma-signatures-0.12.0","ruma-client-0.10.0","ruma-appservice-api-0.7.0","ruma-push-gateway-api-0.6.0","ruma-identity-service-api-0.6.0","ruma-federation-api-0.6.0","ruma-client-api-0.15.0","ruma-common-0.10.0","ruma-common-0.9.2","ruma-0.6.2","ruma-common-0.9.1","ruma-0.6.1","ruma-0.6.0","ruma-state-res-0.7.0","ruma-signatures-0.11.0","ruma-client-0.9.0","ruma-appservice-api-0.6.0","ruma-push-gateway-api-0.5.0","ruma-identity-service-api-0.5.0","ruma-federation-api-0.5.0","ruma-client-api-0.14.0","ruma-common-0.9.0","ruma-0.5.0","ruma-client-0.8.0","ruma-state-res-0.6.0","ruma-appservice-api-0.5.0","ruma-push-gateway-api-0.4.0","ruma-federation-api-0.4.0","ruma-identity-service-api-0.4.0","ruma-client-api-0.13.0","ruma-signatures-0.10.0","ruma-api-0.20.0","ruma-events-0.26.0","ruma-common-0.8.0","ruma-identifiers-0.22.0","ruma-state-res-0.5.0","ruma-api-0.19.0","ruma-events-0.25.0","ruma-common-0.7.0","ruma-identifiers-0.21.0","ruma-serde-0.6.0","ruma-api-0.18.5","ruma-api-0.18.4","ruma-events-0.24.5","ruma-state-res-0.4.1","ruma-federation-api-0.3.1","ruma-0.4.0","ruma-state-res-0.4.0","ruma-client-api-0.12.2","ruma-api-0.18.3","ruma-client-api-0.12.1","ruma-events-0.24.4","ruma-api-0.18.2","ruma-events-0.24.3","ruma-events-0.24.2","ruma-0.3.0","ruma-client-0.7.0","ruma-events-0.24.1","ruma-state-res-0.3.0","ruma-appservice-api-0.4.0","ruma-push-gateway-api-0.3.0","ruma-identity-service-api-0.3.0","ruma-federation-api-0.3.0","ruma-client-api-0.12.0","ruma-api-0.18.1","ruma-signatures-0.9.0","ruma-common-0.6.0","ruma-identifiers-0.20.0","ruma-serde-0.5.0","ruma-client-api-0.11.2","ruma-api-0.17.2","ruma-serde-0.4.2","ruma-events-0.23.3","ruma-events-0.23.2","ruma-api-0.17.1","ruma-events-0.23.1","ruma-identifiers-0.19.4","ruma-serde-0.4.1","ruma-0.2.0","ruma-signatures-0.8.0","ruma-client-0.6.0","ruma-state-res-0.2.0","ruma-appservice-api-0.3.0","ruma-push-gateway-api-0.2.0","ruma-identity-service-api-0.2.0","ruma-federation-api-0.2.0","ruma-client-api-0.11.0","ruma-events-0.23.0","ruma-common-0.5.4","ruma-identifiers-0.19.3","ruma-identifiers-0.19.2","ruma-common-0.5.3","ruma-0.1.2","ruma-signatures-0.7.2","ruma-client-api-0.10.2","ruma-common-0.5.2","ruma-0.1.1","ruma-events-0.22.2","ruma-client-api-0.10.1","ruma-events-0.22.1","ruma-0.1.0","ruma-state-res-0.1.0","ruma-client-0.5.0","ruma-push-gateway-api-0.1.0","ruma-identity-service-api-0.1.0","ruma-appservice-api-0.2.0","ruma-federation-api-0.1.0","ruma-client-api-0.10.0","ruma-api-0.17.0","ruma-events-0.22.0","ruma-common-0.5.1","ruma-signatures-0.7.1","ruma-identifiers-0.19.1","ruma-serde-0.4.0","ruma-client-0.5.0-alpha.2","ruma-0.0.3","ruma-push-gateway-api-0.1.0-alpha.1","ruma-identity-service-api-0.1.0-alpha.1","ruma-federation-api-0.1.0-alpha.2","ruma-client-api-0.10.0-alpha.3","ruma-appservice-api-0.2.0-alpha.3","ruma-api-0.17.0-alpha.4","ruma-events-0.22.0-alpha.3","ruma-common-0.5.0","ruma-signatures-0.7.0","ruma-common-0.4.0","ruma-identifiers-0.19.0","ruma-identifiers-0.18.1","ruma-common-0.3.1","ruma-signatures-0.6.0","ruma-common-0.3.0","ruma-identifiers-0.18.0","ruma-serde-0.3.1","ruma-client-0.5.0-alpha.1","ruma-0.0.2","ruma-push-gateway-api-0.0.1","ruma-identity-service-api-0.0.1","ruma-federation-api-0.1.0-alpha.1","ruma-client-api-0.10.0-alpha.2","ruma-appservice-api-0.2.0-alpha.2","ruma-api-0.17.0-alpha.2","ruma-events-0.22.0-alpha.2","ruma-common-0.3.0-alpha.1","ruma-signatures-0.6.0-alpha.1","ruma-identifiers-0.18.0-alpha.1","ruma-serde-0.3.0","ruma-identifiers-0.17.2","ruma-0.0.1","ruma-client-api-0.10.0-alpha.1","ruma-appservice-api-0.2.0-alpha.1","ruma-federation-api-0.0.3","ruma-api-0.17.0-alpha.1","ruma-events-0.22.0-alpha.1","ruma-serde-0.2.3","ruma-common-0.2.0","ruma-identifiers-0.17.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45057.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N"}]}