`m.room.power_levels` provide no way of restricting the media (via mixins) you can embed into events.

A security/potential problem that was missed in https://github.com/matrix-org/matrix-spec-proposals/pull/1767#discussion_r1621479460.

`m.room.message` doesn't let you do this either, and that's why Mjolnir has protections for removing voice messages and other media automatically.

Start by reviewing the m.room.power_levels and m.room.message event definitions, then read the referenced discussion in matrix-spec-proposals pull request 1767. Determine how media embedded through mixins could be restricted and what protocol-level behavior would define the issue as resolved.

Written by the indexing model from the issue text.