element-hq Vulnerabilities and Affected Products
Vulnerabilities associated with element-web.
Products
Clear product- synapse11 vulnerabilities
- element-web5 vulnerabilities
- element-android3 vulnerabilities
- element-x-android2 vulnerabilities
- element-call1 vulnerability
- element-desktop1 vulnerability
- element-x-ios1 vulnerability
- ess-helm1 vulnerability
- matrix-authentication-service1 vulnerability
- matrix-tools1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
In Element Web and Element Desktop, a malicious room can hide an unrelated room and cause it to be left when the malicious room is leftElement Web is a Matrix web client built using the Matrix React SDK. Element Web and Element Desktop before version 1.11.112 have insufficient validation of room predecessor links, allowing a remote attacker to attempt to impermanently replace a room's entry in the room list with an unrelated attacker-supplied room. While the effect of this is temporary, it may still confuse users into acting on incorrect assumptions. The issue has been patched and users should upgrade to 1.11.112. A reload/refr… CWE-20Sep 16, 2025 | CVSS2.7v4.0 | EPSS0.38% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Element Web could load a malicious instance of Element Call leaking media encryption keysElement Web is a Matrix web client built using the Matrix React SDK. Element Web, starting from version 1.11.16 up to version 1.11.96, can be configured to load Element Call from an external URL. Under certain conditions, the external page is able to get access to the media encryption keys used for an Element Call call. Version 1.11.97 fixes the problem. CWE-497Apr 8, 2025 | CVSS3.8v3.1 | EPSS0.154% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2024-51750MEDIUM | Element allows a malicious homeserver can modify events leading to unrenderable events or roomsElement is a Matrix web client built using the Matrix React SDK. A malicious homeserver can send invalid messages over federation which can prevent Element Web and Desktop from rendering single messages or the entire room containing them. This was patched in Element Web and Desktop 1.11.85. CWE-248Nov 12, 2024 | CVSS5.0v3.1 | EPSS0.476% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Element's thumbnails can be abused to misrepresent the content of an attachmentElement is a Matrix web client built using the Matrix React SDK. Versions of Element Web and Desktop earlier than 1.11.85 do not check if thumbnails for attachments, stickers and images are coherent. It is possible to add thumbnails to events trigger a file download once clicked. Fixed in element-web 1.11.85. CWE-451Nov 12, 2024 | CVSS3.5v3.1 | EPSS0.33% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2024-47779HIGH | Element Web vulnerable to potential exposure of access token via authenticated mediaElement is a Matrix web client built using the Matrix React SDK. Element Web versions 1.11.70 through 1.11.80 contain a vulnerability which can, under specially crafted conditions, lead to the access token becoming exposed to third parties. At least one vector has been identified internally, involving malicious widgets, but other vectors may exist. Note that despite superficial similarity to CVE-2024-47771, this is an entirely separate vulnerability, caused by a separate piece of code included o… CWE-200Oct 15, 2024 | CVSS7.0v4.0 | EPSS0.435% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |