Rust advisories / matrix-sdk-ui
Vulnerability MediumRUSTSEC-2026-0158 · matrix-sdk-ui
RUSTSEC-2026-0158: Incomplete message edit validation in matrix-sdk-ui
Short answerA security vulnerability in the matrix-sdk-ui crate: Incomplete message edit validation in matrix-sdk-ui. Medium severity (CVSS 4.9). Fixed in 0.16.1: update to a fixed version.
| Crate | matrix-sdk-ui |
|---|---|
| Type | Vulnerability |
| Affected versions | Before 0.16.1. |
| Fixed in | 0.16.1 |
| Severity | Medium, CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N |
| Published | 2026-06-03 |
| Last changed | 2026-10-12 |
| Also known as | CVE-2026-45057, GHSA-h97m-27fx-42rx |
What to do
- See which version you have:
cargo tree -i matrix-sdk-ui(it also shows which of your dependencies pulls it in). - Update within your version requirement:
cargo update -p matrix-sdk-ui. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for examplematrix-sdk-ui = "0.16.1") or update the dependency that pulls it in. - Check again with
cargo audit, or paste your Cargo.lock into our Cargo.toml checker.
Details from the advisory
The message edit validation logic in the matrix-sdk-ui crate before 0.16.1 is missing a check: when replacing an encrypted event, the replacement event itself is not required to be encrypted. This enables a malicious homeserver administrator (or an actor with equivalent power) to impersonate or spoof messages as if they were sent by a victim user.
References
- Package: crates.io/crates/matrix-sdk-ui
- Advisory: rustsec.org/advisories/RUSTSEC-2026-0158.html
- Web: github.com/matrix-org/matrix-rust-sdk/pull/6454
From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.
Up next
Are you affected?Check your whole dependency treePaste Cargo.lock: every advisory, for your exact versions.Read it next →Also worth your time
Did this answer your question?