{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2025-68667 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2025-68667 yet. Limit exposure of the affected software until one is available.","what":"CVE-2025-68667 is a critical vulnerability in continuwuity, published on 23 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-68667 and fix it if it is affected.\n\nWhat it is: CVE-2025-68667 is a critical vulnerability in continuwuity, published on 23 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-68667 in the wild and no public exploit code.\n\nAffected product: continuwuity. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-68667/ (Markdown: https://insights.sbomify.com/CVE-2025-68667/index.md)","id":"CVE-2025-68667","markdown":"https://insights.sbomify.com/CVE-2025-68667/index.md","name":"CVE-2025-68667","record":{"aliases":["GHSA-22fw-4jq7-g8r8"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["data_read","denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Matrix chat server","requires_auth":"none","summary":"Remote attackers can forge membership events to remove users or join private rooms, exposing data and causing denial of service.","user_interaction":"not_required","vuln_class":"business_logic"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":9.9,"severity":"critical","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:L","version":"4.0"},"cwes":[{"id":"CWE-441","name":"Unintended Proxy or Intermediary"},{"id":"CWE-20","name":"Improper Input Validation"}],"description":"Conduit is a chat server powered by Matrix. A vulnerability that affects a number of Conduit-derived homeservers allows a remote, unauthenticated attacker to force the target server to cryptographically sign arbitrary membership events. Affected products include Conduit prior to version 0.10.10, continuwuity prior to version 0.5.0, Grapevine prior to commit `9a50c244`, and tuwunel prior to version 1.4.8. The flaw exists because the server fails to validate the origin of a signing request, provided the event's state_key is a valid user ID belonging to the target server. Attackers can forge \"leave\" events for any user on the target server. This forcibly removes users (including admins and bots) from rooms. This allows denial of service and/or the removal of technical protections for a room (including policy servers, if all users on the policy server are removed). Attackers can forge \"invite\" events from a victim user to themselves, provided they have an account on a server where there is an account that has the power level to send invites. This allows the attacker to join private or invite-only rooms accessible by the victim, exposing confidential conversation history and room state. Attackers can forge \"ban\" events from a victim user to any user below the victim user's power level, provided the victim has the power level to issue bans AND the target of the ban resides on the same server as the victim. This allows the attacker to ban anyone in a room who is on the same server as the vulnerable one, however cannot exploit this to ban users on other servers or the victim themself. Conduit fixes the issue in version 0.10.10. continuwuity fixes the issue in commits `7fa4fa98` and `b2bead67`, released in 0.5.0. tuwunel fixes the issue in commit `dc9314de1f8a6e040c5aa331fe52efbe62e6a2c3`, released in 1.4.8. Grapevine fixes the issue in commit `9a50c2448abba6e2b7d79c64243bb438b351616c`. As a workaround, block access to the `PUT /_matrix/federation/v2/invite/{roomId}/{eventId}` endpoint using your reverse proxy.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"Conduit-derived homeservers are affected by a Confused Deputy and Improper Input Validation issue","id":"CVE-2025-68667","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"business_logic","year":"2025"},"n_packages":0,"n_references":6,"next":{"headline":"n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node","id":"CVE-2025-68668"},"packages":[],"prev":{"headline":"Discourse users archives leaked to users with moderation privileges","id":"CVE-2025-68666"},"products":["continuwuity"],"published":"2025-12-23","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2025-12-26","vendors":["continuwuity"]},"summary":"Remote attackers can forge membership events to remove users or join private rooms, exposing data and causing denial of service.","url":"https://insights.sbomify.com/CVE-2025-68667/"}