# UNDF: UNDF-2026-000000062
--- a/apps/web/src/TextForEvent.tsx
+++ b/apps/web/src/TextForEvent.tsx
@@ -499,15 +499,12 @@ function textForPowerEvent(event: MatrixEvent, allowJSX: boolean, isHistoric: b
     const previousUserDefault: number = event.getPrevContent().users_default || 0;
     const currentUserDefault: number = event.getContent().users_default || 0;
-    // Construct set of userIds
-    const users: string[] = [];
-    Object.keys(event.getContent().users).forEach((userId) => {
-        if (users.indexOf(userId) === -1) users.push(userId);
-    });
-    Object.keys(event.getPrevContent().users).forEach((userId) => {
-        if (users.indexOf(userId) === -1) users.push(userId);
-    });
+    // CWE-407 fix: use Set for O(1) dedup instead of O(n²) indexOf dedup.
+    // For a room with N users in power levels, old code: O(N²); new code: O(N).
+    const users: string[] = Array.from(
+        new Set([
+            ...Object.keys(event.getContent().users),
+            ...Object.keys(event.getPrevContent().users),
+        ])
+    );

     const diffs: {