What’s Vulnerable › Vulnerabilities

CVE-2024-47771: Element Desktop vulnerable to potential exposure of access token via authenticated media

• Severity: high (CVSS 7.0 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-10-15 · updated 2026-06-17
• Weakness: CWE-200

Description

Element Desktop is a Matrix client for desktop platforms. Element Desktop versions 1.11.70 through 1.11.80 contain a vulnerability which can, under specially crafted conditions, lead to the access token becoming exposed to third parties. At least one vector has been identified internally, involving malicious widgets, but other vectors may exist. Users are strongly advised to upgrade to version 1.11.81 to remediate the issue. As a workaround, avoid granting permissions to untrusted widgets.

Affected products

• element-hq element-desktop: from 1.11.70, < 1.11.81

References

• https://github.com/element-hq/element-desktop/commit/6c78684e84ba7f460aedba6f017760e2323fdf4b
• https://github.com/element-hq/element-desktop/security/advisories/GHSA-963w-49j9-gxj6
• https://github.com/element-hq/element-web/commit/63c8550791a0221189f495d6458fee7db601c789

Get alerted when CVE-2024-47771 or the next vulnerability affects your stack