{"id":"CVE-2024-40648","aliases":["RUSTSEC-2024-0356","GHSA-4qg4-cvh2-crgg"],"title":"`UserIdentity::is_verified` not checking verification status of own user identity while performing the check","summary":"`UserIdentity::is_verified` not checking verification status of own user identity while performing the check","severity":"none","vendor":"matrix-sdk-crypto","product":"matrix-sdk-crypto","ecosystem":"rust","affected":["matrix-sdk-crypto >= 0.0.0-0, < 0.7.2"],"patched":["matrix-sdk-crypto 0.7.2"],"published":"2024-07-18","updated":"2026-10-12","sourceUpdated":"2026-10-12T18:00:12.405685687Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2024-0356","references":[{"url":"https://crates.io/crates/matrix-sdk-crypto"},{"url":"https://rustsec.org/advisories/RUSTSEC-2024-0356.html"},{"url":"https://github.com/matrix-org/matrix-rust-sdk/commit/76a7052149bb8f722df12da915b3a06d19a6695a"}],"tags":["osv","rust"],"epss":0.0028,"epssPercentile":0.18834,"ingestedAt":"2026-10-13T11:45:30.169Z","slug":"CVE-2024-40648","body":"## Overview\n\nThe `UserIdentity::is_verified()` method in the matrix-sdk-crypto crate before\nversion 0.7.2 doesn't take into account the verification status of the user's\nown identity while performing the check and may as a result return a value\ncontrary to what is implied by its name and documentation.\n\n## Impact\n\nIf the method is used to decide whether to perform sensitive operations towards\na user identity, a malicious homeserver could manipulate the outcome in order to\nmake the identity appear trusted. This is not a typical usage of the method,\nwhich lowers the impact. The method itself is not used inside the\nmatrix-sdk-crypto crate.\n\n## Affected packages\n\n- `matrix-sdk-crypto >= 0.0.0-0, < 0.7.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `matrix-sdk-crypto 0.7.2`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}