MATRIX PROTOCOL BUGS COULD LET HACKERS SEIZE CONTROL OF SENSITIVE CHAT ROOMS

Summary from the TLDR InfoSec newsletter

Matrix Foundation identified two high-severity vulnerabilities (CVE-2025-49090 and CVE-2025-54315) that allow attackers to hijack creator privileges or predict room addresses, disrupting communications used by government and military groups. These flaws affect federated Matrix servers (external servers - internal ones are unaffected) and were fixed in Room Version 12. Administrators are urged to upgrade immediately and restrict access to trusted servers. No exploits have been observed in the wild.