In Bouncy Castle for Java before version 1.86, the method org.bouncycastle.mls.protocol.Group.validateExternalCachedProposals failed to properly validate the relationship between the removed leaf in an MLS external commit and the joiner. RFC 9420 section 12.2 allows at most one Remove proposal in an external commit, which must remove an old version of the joiner and requires credential checks on the removed leaf. The existing validation counted proposals and bounded the removed leaf index but did not verify that the removed leaf belonged to the joiner. This omission allowed any party with the group's public GroupInfo to submit an external commit that removes any member by LeafIndex, causing all members to apply the removal and allowing the attacker to take over that member's slot in the ratchet tree. The credential check that should have prevented this was only present in the gRPC interop harness, leaving other API callers unprotected. The fix requires that an external commit with a Remove proposal is accepted only if the removed leaf's credential matches the joiner's new leaf credential on both sending and receiving sides.

An attacker with access to the group's public GroupInfo can craft an external commit that removes any group member by LeafIndex, causing all members to evict that member and allowing the attacker to take over their slot in the ratchet tree. This compromises group membership integrity and could lead to unauthorized access or disruption of group communication. The vulnerability affects confidentiality and integrity of MLS group operations.

Upgrade Bouncy Castle for Java to version 1.86 or later, where the vulnerability is fixed by enforcing credential checks on removed leaves in external commits. Until upgraded, be aware that the public GroupInfo can be used to perform unauthorized removals via external commits. No other mitigations are specified. Patch status is confirmed fixed in version 1.86.