Moderation Tool Vulnerability in Mjolnir by Matrix
CVE-2025-24024

9.1CRITICAL

Key Information:

Vendor

Matrix-org

Status
Mjolnir
Vendor
CVE Published:
21 January 2025

What is CVE-2025-24024?

Mjolnir, a moderation tool for the Matrix communication platform, has a vulnerability that allows unauthorized users to execute management commands from any room where the bot is present. This poses significant risks, particularly if server administration features are enabled. Effective versions that address this issue include v1.9.1, which reverses the problematic feature, and v1.9.2, which safely reintroduces the necessary functionalities. Users unable to upgrade to these versions are advised to downgrade to v1.8.3 to mitigate potential exploits.

Affected Version(s)

mjolnir = 1.9.0

References

https://github.com/matrix-org/mjolnir/security/advisories...
x_refsource_CONFIRM
https://github.com/matrix-org/mjolnir/commit/b437fa16b542...
x_refsource_MISC
https://github.com/matrix-org/mjolnir/commit/d0ef527a9e3e...
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.