{"id":"CVE-2024-40648","aliases":["EUVD-2024-2249","GHSA-4qg4-cvh2-crgg","RUSTSEC-2024-0356","openSUSE-SU-2024:14224-1"],"status":"published","title":"`UserIdentity::is_verified` not checking verification status of own user identity while performing the check in matrix-rust-sdk","description":"matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. The `UserIdentity::is_verified()` method in the matrix-sdk-crypto crate before version 0.7.2 doesn't take into account the verification status of the user's own identity while performing the check and may as a result return a value contrary to what is implied by its name and documentation. If the method is used to decide whether to perform sensitive operations towards a user identity, a malicious homeserver could manipulate the outcome in order to make the identity appear trusted. This is not a typical usage of the method, which lowers the impact. The method itself is not used inside the `matrix-sdk-crypto` crate. The 0.7.2 release of the `matrix-sdk-crypto` crate includes a fix. All users are advised to upgrade. There are no known workarounds for this vulnerability.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0028,"percentile":0.20612,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287","CWE-863"],"published":"2024-07-18T12:00:00Z","modified":"2026-11-04T02:46:18Z","fixes":[{"ecosystem":"crates.io","package":"matrix-sdk-crypto","fixed_in":["0.7.2"],"sources":["ghsa","osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"cargo-audit-advisory-db","fixed_in":["20240730-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"matrix-sdk-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"matrix-sdk-crypto","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.7.2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"matrix-sdk-crypto","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.7.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cargo-audit-advisory-db","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20240730-1.1"}]}]}],"products":[{"vendor":"matrix-org","product":"matrix-rust-sdk"}],"references":[{"url":"https://github.com/matrix-org/matrix-rust-sdk/security/advisories/GHSA-4qg4-cvh2-crgg","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"https://github.com/matrix-org/matrix-rust-sdk/commit/76a7052149bb8f722df12da915b3a06d19a6695a","tags":["x_refsource_MISC","x_transferred","fix","web"]},{"url":"https://github.com/matrix-org/matrix-rust-sdk/releases/tag/0.7.2-crypto","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40648","tags":["advisory"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2024-0356.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-4qg4-cvh2-crgg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/40xxx/CVE-2024-40648.json","tags":["advisory"]},{"url":"https://github.com/matrix-org/matrix-rust-sdk","tags":["package"]},{"url":"https://crates.io/crates/matrix-sdk-crypto","tags":["package"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40648","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-40648","title":"`UserIdentity::is_verified` not checking verification status of own user identity while performing the check in matrix-rust-sdk","description":"matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. The `UserIdentity::is_verified()` method in the matrix-sdk-crypto crate before version 0.7.2 doesn't take into account the verification status of the user's own identity while performing the check and may as a result return a value contrary to what is implied by its name and documentation. If the method is used to decide whether to perform sensitive operations towards a user identity, a malicious homeserver could manipulate the outcome in order to make the identity appear trusted. This is not a typical usage of the method, which lowers the impact. The method itself is not used inside the `matrix-sdk-crypto` crate. The 0.7.2 release of the `matrix-sdk-crypto` crate includes a fix. All users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-07-18T16:45:56.321Z","modified":"2024-08-02T04:33:11.826Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:34:06.811965Z"}],"euvd":[{"id":"EUVD-2024-2249","description":"matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. The `UserIdentity::is_verified()` method in the matrix-sdk-crypto crate before version 0.7.2 doesn't take into account the verification status of the user's own identity while performing the check and may as a result return a value contrary to what is implied by its name and documentation. If the method is used to decide whether to perform sensitive operations towards a user identity, a malicious homeserver could manipulate the outcome in order to make the identity appear trusted. This is not a typical usage of the method, which lowers the impact. The method itself is not used inside the `matrix-sdk-crypto` crate. The 0.7.2 release of the `matrix-sdk-crypto` crate includes a fix. All users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-07-18T16:45:56Z","modified":"2024-08-02T04:33:11Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T03:50:17.469599Z"}],"ghsa":[{"id":"GHSA-4qg4-cvh2-crgg","title":"matrix-sdk-crypto's `UserIdentity::is_verified` not checking verification status of own user identity while performing the check","description":"The `UserIdentity::is_verified()` method in the matrix-sdk-crypto crate before version 0.7.2 doesn't take into account the verification status of the user's own identity while performing the check and may as a result return a value contrary to what is implied by its name and documentation.\n\n### Impact\n\nIf the method is used to decide whether to perform sensitive operations towards a user identity, a malicious homeserver could manipulate the outcome in order to make the identity appear trusted. This is not a typical usage of the method, which lowers the impact. The method itself is not used inside the `matrix-sdk-crypto` crate.\n\n### Patches\n\nThe 0.7.2 release of the `matrix-sdk-crypto` crate includes a fix.\n\n### Workarounds\n\nNone.\n","status":"published","published":"2024-07-18T15:28:07Z","modified":"2024-08-08T05:08:54Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-287","CWE-863"],"updated_at":"2026-11-02T14:37:58.427757Z"}],"nvd":[{"id":"CVE-2024-40648","description":"matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. The `UserIdentity::is_verified()` method in the matrix-sdk-crypto crate before version 0.7.2 doesn't take into account the verification status of the user's own identity while performing the check and may as a result return a value contrary to what is implied by its name and documentation. If the method is used to decide whether to perform sensitive operations towards a user identity, a malicious homeserver could manipulate the outcome in order to make the identity appear trusted. This is not a typical usage of the method, which lowers the impact. The method itself is not used inside the `matrix-sdk-crypto` crate. The 0.7.2 release of the `matrix-sdk-crypto` crate includes a fix. All users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-07-18T17:15:05.427Z","modified":"2026-06-17T07:46:14.303Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:10:13.413515Z"}],"osv":[{"id":"CVE-2024-40648","title":"`UserIdentity::is_verified` not checking verification status of own user identity while performing the check in matrix-rust-sdk","description":"matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. The `UserIdentity::is_verified()` method in the matrix-sdk-crypto crate before version 0.7.2 doesn't take into account the verification status of the user's own identity while performing the check and may as a result return a value contrary to what is implied by its name and documentation. If the method is used to decide whether to perform sensitive operations towards a user identity, a malicious homeserver could manipulate the outcome in order to make the identity appear trusted. This is not a typical usage of the method, which lowers the impact. The method itself is not used inside the `matrix-sdk-crypto` crate. The 0.7.2 release of the `matrix-sdk-crypto` crate includes a fix. All users are advised to upgrade. There are no known workarounds for this vulnerability.","status":"published","published":"2024-07-18T16:45:56.321Z","modified":"2026-11-04T02:46:18.384429853Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-287"],"updated_at":"2026-11-04T02:53:57.551196Z"},{"id":"GHSA-4qg4-cvh2-crgg","title":"matrix-sdk-crypto's `UserIdentity::is_verified` not checking verification status of own user identity while performing the check","description":"The `UserIdentity::is_verified()` method in the matrix-sdk-crypto crate before version 0.7.2 doesn't take into account the verification status of the user's own identity while performing the check and may as a result return a value contrary to what is implied by its name and documentation.\n\n### Impact\n\nIf the method is used to decide whether to perform sensitive operations towards a user identity, a malicious homeserver could manipulate the outcome in order to make the identity appear trusted. This is not a typical usage of the method, which lowers the impact. The method itself is not used inside the `matrix-sdk-crypto` crate.\n\n### Patches\n\nThe 0.7.2 release of the `matrix-sdk-crypto` crate includes a fix.\n\n### Workarounds\n\nNone.\n","status":"published","published":"2024-07-18T15:28:07Z","modified":"2026-09-10T03:50:16.296282253Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-287","CWE-863"],"updated_at":"2026-11-02T15:46:37.148947Z"},{"id":"openSUSE-SU-2024:14224-1","title":"cargo-audit-advisory-db-20240730-1.1 on GA media","description":"These are all security issues fixed in the cargo-audit-advisory-db-20240730-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-30T00:00:00Z","modified":"2026-02-04T04:34:56.594935Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"RUSTSEC-2024-0356","title":"`UserIdentity::is_verified` not checking verification status of own user identity while performing the check","description":"The `UserIdentity::is_verified()` method in the matrix-sdk-crypto crate before\nversion 0.7.2 doesn't take into account the verification status of the user's\nown identity while performing the check and may as a result return a value\ncontrary to what is implied by its name and documentation.\n\n## Impact\n\nIf the method is used to decide whether to perform sensitive operations towards\na user identity, a malicious homeserver could manipulate the outcome in order to\nmake the identity appear trusted. This is not a typical usage of the method,\nwhich lowers the impact. The method itself is not used inside the\nmatrix-sdk-crypto crate.","status":"published","published":"2024-07-18T12:00:00Z","modified":"2026-10-12T18:00:12.405685687Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}