CVE-2026-24471
CriticalSummary
Vulnerability in the continuwuity Matrix homeserver written in Rust allows an attacker with a malicious remote server to cause the local server to sign an arbitrary event upon user interaction. When a user account leaves a room (rejecting an invite), joins a room, or knocks on a room, the victim server may ask a remote server for assistance. If the victim asks the attacker server for assistance, the attacker can provide an arbitrary event, which the victim will sign and return. For the /leave endpoint, this works for any event with a supported room version, where origin and origin_server_ts are set by the victim. For /join, an additional victim-set content field in the format of a join membership is needed. For /knock, an additional victim-set content field in the format of a knock membership and a room version not between 1 and 6 is needed.
Risk Assessment
An attacker can cause arbitrary events to be signed, potentially leading to integrity and authenticity breaches in the Matrix network, as well as privilege escalation or propagation of malicious content.
Recommendation
It is recommended to update the continuwuity server to a patched version. Also, monitor logs for unusual assistance requests to remote servers.
Related vulnerabilities
- CVE-2026-59105Critical
Jumis (formerly Tildes Jumis) creates a Microsoft SQL Server login named ##Tilde_JumisAdmin## whose password is derived deterministically from a single non-secret input — the SQL Server name (@@servername). The derivation algorithm is hard-coded in the client application and identical across every installation, and it contains a hard-coded secret key. Because the only input (the server name) is not secret, anyone able to reach a Jumis SQL Server can compute the password offline and authenticate.
- CVE-2026-123488Critical
Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote attackers can read and write the database, setting the admin flag or overwriting password hashes in the users table to gain administrator access.
- CVE-2026-114630Critical
The ELEX WordPress HelpDesk & Customer Ticketing System plugin is vulnerable to arbitrary file deletion due to insufficient file path validation in the factory_reset function in all versions up to, and including, 3.3.8. Unauthenticated attackers can delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The vulnerability is exploited via a two-step chain: storing an arbitrary ticket_attachment_path value through the public AJAX endpoint, then triggering the factory_reset routine via a GET request.
- CVE-2026-107622Critical
The BuddyForms plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.10.5 via a form-type confusion attack through the bf_post_type parameter. Unauthenticated attackers can insert a rogue BuddyForms form configuration with an attacker-controlled new_user_role value into the live global form registry, then submit a registration through that form to create a new WordPress account with administrator-level privileges. Exploitation requires "Anyone can register" enabled and at least one public BuddyForms form attached to a page.
- CVE-2026-123294Critical
In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow.
- CVE-2026-123279Critical
In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators.
- CVE-2026-88800Critical
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce. The guard meant to protect roles with assigned users reads a different part of the request than the one selecting what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, permanently stripping every user of their capabilities.
- CVE-2026-120844Critical
Incorrect Privilege Assignment vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) through 7.1.3 allows Privilege Escalation.
- CVE-2026-119516Critical
Deserialization of Untrusted Data vulnerability in Radius Booking — Booking Calendar for Appointments & Services through 1.0.20 allows Object Injection.
- CVE-2026-118423Critical
The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.
Original NVD description (English source)
continuwuity is a Matrix homeserver written in Rust. This vulnerability allows an attacker with a malicious remote server to cause the local server to sign an arbitrary event upon user interaction. Upon a user account leaving a room (rejecting an invite), joining a room or knocking on a room, the victim server may ask a remote server for assistance. If the victim asks the attacker server for assistance the attacker is able to provide an arbitrary event, which the victim will sign and return to the attacker. For the /leave endpoint, this works for any event with a supported room version, where the origin and origin_server_ts is set by the victim. For the /join endpoint, an additionally victim-set content field in the format of a join membership is needed. For the /knock endpoint, an additional victim-set content field in the format of a knock membership and a room version not between 1 and 6 is needed. This was exploited as a part of a larger chain against the continuwuity.org homeserve
Vulnerability data from NVD (NIST) · CISA KEV · EPSS