What’s Vulnerable › Products

element-hq element-web vulnerabilities

7 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your element-hq element-web version is affected

Latest element-hq element-web vulnerabilities

• CVE-2026-119407 — Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters (CVSS 7.1)
• CVE-2026-55850 — Element Web: A malicious homeserver can inject HTML in Element Web using its homepage (CVSS 5.3)
• CVE-2025-59161 — In Element Web and Element Desktop, a malicious room can hide an unrelated room and cause it to be left when the malicious room is left (CVSS 2.7)
• CVE-2025-32026 — Element Web could load a malicious instance of Element Call leaking media encryption keys (CVSS 3.8)
• CVE-2024-51750 — Element allows a malicious homeserver can modify events leading to unrenderable events or rooms (CVSS 5.0)
• CVE-2024-51749 — Element's thumbnails can be abused to misrepresent the content of an attachment (CVSS 3.5)
• CVE-2024-47779 — Element Web vulnerable to potential exposure of access token via authenticated media (CVSS 7.0)