matrix-sdk-crypto's `UserIdentity::is_verified` not checking verification status of own user identity while performing the checkGHSA-4qg4-cvh2-crgg
MEDIUMFix: matrix-org/matrix-rust-sdk@76a7052GHSA-4qg4-cvh2-crgg is a medium-severity (CVSS 4.8) Improper Authentication vulnerability in matrix-sdk-crypto. A fix is available for matrix-sdk-crypto — see the affected versions and patch details below.
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for GHSA-4qg4-cvh2-crgg.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
matrix-sdk-cryptoReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects crates.io packages — download data is not available via public APIs for these ecosystems.
Description
matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. The UserIdentity::is_verified() method in the matrix-sdk-crypto crate before version 0.7.2 doesn't take into account the verification status of the user's own identity while performing the check and may as a result return a value contrary to what is implied by its name and documentation. If the method is used to decide whether to perform sensitive operations towards a user identity, a malicious homeserver could manipulate the outcome in order to make the identity appear trusted. This is not a typical usage of the method, which lowers the impact. The method itself is not used inside the matrix-sdk-crypto crate. The 0.7.2 release of the matrix-sdk-crypto crate includes a fix. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🦀crates.io | matrix-sdk-crypto | all versions | 0.7.2cargo update -p matrix-sdk-crypto --precise 0.7.2 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for matrix-sdk-crypto, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update matrix-sdk-crypto to 0.7.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-4qg4-cvh2-crgg is resolved across your whole dependency graph.
Workarounds
Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.
Frequently Asked Questions
Is GHSA-4qg4-cvh2-crgg in your dependencies?
Find it across crates.io, including transitive dependencies.