CVE-2022-41904

Element iOS is an iOS Matrix client provided by Element. It is based on MatrixSDK. Prior to version 1.9.7, events encrypted using Megolm for which trust could not be established did not get decorated accordingly (with warning shields). Therefore a malicious homeserver could inject messages into the room without the user being alerted that the messages were not sent by a verified group member, even if the user has previously verified all group members. This issue has been patched in Element iOS 1.9.7. There are currently no known workarounds.

• CWE-357

• https://github.com/vector-im/element-ios/releases/tag/v1.9.7Release Notes, Third Party Advisory
• https://github.com/vector-im/element-ios/security/advisories/GHSA-fm8m-99j7-323gThird Party Advisory
• https://github.com/vector-im/element-ios/releases/tag/v1.9.7Release Notes, Third Party Advisory
• https://github.com/vector-im/element-ios/security/advisories/GHSA-fm8m-99j7-323gThird Party Advisory

Published

Nov 11, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-41899TensorFlow is an open source platform for machine learning. …7.5
• CVE-2022-4190Insufficient data validation in Directory in Google Chrome p…8.8
• CVE-2022-41900TensorFlow is an open source platform for machine learning. …9.8
• CVE-2022-41901TensorFlow is an open source platform for machine learning. …7.5
• CVE-2022-41902TensorFlow is an open source platform for machine learning. …9.1
• CVE-2022-41903Git is distributed revision control system. `git log` can di…9.8
• CVE-2022-41905WsgiDAV is a generic and extendable WebDAV server based on W…6.1
• CVE-2022-41906OpenSearch Notifications is a notifications plugin for OpenS…8.7
• CVE-2022-41907TensorFlow is an open source platform for machine learning. …7.5
• CVE-2022-41908TensorFlow is an open source platform for machine learning. …7.5
• CVE-2022-41909TensorFlow is an open source platform for machine learning. …7.5
• CVE-2022-4191Use after free in Sign-In in Google Chrome prior to 108.0.53…8.8