CVE-2026-45057: 
Rust vulnerability analysis and mitigation

CVE-2026-45057 is an incomplete message edit validation vulnerability in the matrix-sdk-ui Rust crate, a GUI-centric utility layer built on top of matrix-rust-sdk. The flaw allows malicious homeserver administrators (or actors with equivalent privilege) to impersonate or spoof messages as if they were sent by a victim user by sending unencrypted replacement events for originally encrypted messages. Affected versions are all releases of matrix-sdk-ui prior to 0.16.1. The vulnerability was published on June 3–4, 2026, and carries a CVSS v3.1 base score of 4.9 (Medium) (Github Advisory, GitHub Security Advisory).

The root cause is classified under CWE-345 (Insufficient Verification of Data Authenticity) and CWE-649 (Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking). Specifically, the message edit validation logic in matrix-sdk-ui failed to enforce that a replacement event for an encrypted message must itself be encrypted — a requirement defined in the Matrix specification's replacement event validity algorithm. This gap existed in multiple code paths, including timeline aggregation and the latest event module, as the validation logic was not centralized. An attacker with homeserver administrator privileges (or equivalent) could craft and inject an unencrypted m.room.message replacement event targeting an encrypted original event, causing clients to display the spoofed content as if it originated from the victim user (Github Advisory, GitHub PR #6454).

Successful exploitation allows a malicious homeserver administrator to alter the displayed content of encrypted messages in Matrix rooms, effectively impersonating any user on that homeserver by replacing their encrypted messages with attacker-controlled unencrypted content. The integrity impact is rated High, as message authenticity guarantees are completely undermined for affected clients. There is no confidentiality or availability impact; however, the ability to spoof communications in encrypted channels poses significant trust and social engineering risks in sensitive deployments (Github Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). Exploitation requires High privileges — specifically, homeserver administrator access or equivalent — making opportunistic exploitation unlikely. The EPSS score is approximately 0.019% (0.000190), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Gain homeserver admin access: The attacker must control or compromise a Matrix homeserver with administrative privileges, or operate a malicious homeserver federated with the target room.
2. Identify target encrypted message: Locate an encrypted message (m.room.encrypted) sent by a victim user in a room where the attacker's homeserver has visibility.
3. Craft a spoofed replacement event: Construct an unencrypted m.room.message event with m.relates_to set to m.replace referencing the original encrypted event's event ID, containing attacker-controlled message content.
4. Inject the replacement event: Send the crafted unencrypted replacement event to the room via the homeserver's federation or client-server API, bypassing the missing encryption check in vulnerable matrix-sdk-ui clients.
5. Victim client displays spoofed content: Vulnerable clients running matrix-sdk-ui < 0.16.1 accept the unencrypted replacement without validating that it must also be encrypted, rendering the attacker's content as an edit attributed to the victim user (Github Advisory, GitHub PR #6454).

• Network: Unexpected m.room.message replacement events (with m.relates_to.rel_type: m.replace) appearing in rooms where the original event was of type m.room.encrypted; unencrypted events referencing encrypted event IDs in Matrix room timelines.
• Logs: Matrix client or server logs showing edit/replacement events where the replacement event type is m.room.message but the original event type is m.room.encrypted; mismatches between event encryption status in room state logs.
• Application Behavior: Messages in encrypted rooms appearing to be edited but displaying without the expected encryption indicator; client UI showing edited message content that does not match what the purported sender would have access to send unencrypted.

The fix is available in matrix-sdk-ui version 0.16.1 (released as part of matrix-sdk 0.16.1 on May 8, 2026), which enforces that replacement events for encrypted messages must themselves be encrypted, aligning with the Matrix specification's replacement event validity algorithm (GitHub Release, Github Advisory). No configuration-based workarounds are available. Organizations and developers using matrix-sdk-ui in client applications should update their dependency to version 0.16.1 or later immediately. The fix was implemented via PR #6454, which introduced a common validation method used across timeline aggregation, the latest event module, and thread summary logic (GitHub PR #6454).