CVE-2025-48937

Name of the Vulnerable Software and Affected Versions matrix-rust-sdk versions 0.8.0 through 0.11.0

Description The issue arises from the failure to correctly validate the sender of an encrypted event in the matrix-sdk-crypto component. This allows a malicious homeserver operator to modify events served to clients, making those events appear to the recipient as if they were sent by another user.

Recommendations For versions 0.8.0 through 0.11.0, update to version 0.11.1 or 0.12.0 to resolve the issue.