CVE-2020-26547

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-02-01 · updated 2026-06-17
Weakness: CWE-345

Description

Monal before 4.9 does not implement proper sender verification on MAM and Message Carbon (XEP-0280) results. This allows a remote attacker (able to send stanzas to a victim) to inject arbitrary messages into the local history, with full control over the sender and receiver displayed to the victim.

Affected products

Monal: before 4.9 — fixed in 4.9

How to fix

Upgrade to a fixed version: Monal 4.9. Check the vendor advisory for mitigations.

References

https://github.com/anurodhp/Monal/commits/develop
https://monal.im/blog/cve-2020-26547/
https://github.com/anurodhp/Monal/commits/develop
https://monal.im/blog/cve-2020-26547/

Get alerted when CVE-2020-26547 or the next vulnerability affects your stack