Matrix Specification Room Event Uniqueness Vulnerability

A vulnerability exists in the Matrix specification prior to version 1.16, specifically in rooms using a version earlier than 12, due to a lack of uniqueness for create events. This deficiency could potentially allow for multiple create events to be introduced into a room, leading to unauthorized control over the room's state and permissions.

Impact

The vulnerability could disrupt room management by allowing a malicious homeserver operator to corrupt the room's state, such as by reverting access controls or membership to a previous state. This does not expose conversation history or additional data.

Remediation

Matrix servers should be upgraded to version 1.16 and rooms should be upgraded to version 12 to address this vulnerability.