CVE-2020-26547: 
Homebrew vulnerability analysis and mitigation

Monal before version 4.9 contained a vulnerability in its implementation of sender verification for MAM (Message Archive Management) and Message Carbon (XEP-0280) results. The vulnerability was assigned CVE-2020-26547 and was disclosed in January 2021 (NVD).

The vulnerability stems from improper implementation of sender verification mechanisms in MAM and Message Carbon (XEP-0280) functionalities. The CVSS v3.1 base score is 9.8 CRITICAL with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-345 (Insufficient Verification of Data Authenticity) (NVD).

When exploited, this vulnerability allows a remote attacker who can send stanzas to a victim to inject arbitrary messages into the local message history. The attacker gains full control over both the sender and receiver information displayed to the victim (NVD).

The vulnerability is remotely exploitable by an attacker who has the ability to send stanzas to a victim. No authentication or user interaction is required for exploitation, as indicated by the CVSS vector showing Network access vector (AV:N) with Low attack complexity (AC:L) and No privileges required (PR:N) (NVD).

The vulnerability was fixed in Monal version 4.9. Users should upgrade to version 4.9 or later to mitigate this security issue (NVD).