CVE-2024-47779: high-severity vulnerability in element-hq element-web
Element Web vulnerable to potential exposure of access token via authenticated media
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7epss 0.4%
Element is a Matrix web client built using the Matrix React SDK. Element Web versions 1.11.70 through 1.11.80 contain a vulnerability which can, under specially crafted conditions, lead to the access token becoming exposed to third parties. At least one vector has been identified internally, involving malicious widgets, but other vectors may exist. Note that despite superficial similarity to CVE-2024-47771, this is an entirely separate vulnerability, caused by a separate piece of code included only in Element Web. Element Web and Element Desktop share most but not all, of their code and this vulnerability exists in the part of the code base which is not shared between the projects. Users are strongly advised to upgrade to version 1.11.81 to remediate the issue. As a workaround, avoid granting permissions to untrusted widgets.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
element-hq · element-webRelated CVEs — element-hq element-web
In the same product, most dangerous first.
CVE-2026-55850MEDIUMElement Web: A malicious homeserver can inject HTML in Element Web using its homepageEPSS 0.5%CVE-2024-51750MEDIUMElement allows a malicious homeserver can modify events leading to unrenderable events or roomsEPSS 0.5%CVE-2025-59161LOWIn Element Web and Element Desktop, a malicious room can hide an unrelated room and cause it to be left when the malicious room is leftEPSS 0.4%CVE-2024-51749LOWElement's thumbnails can be abused to misrepresent the content of an attachmentEPSS 0.4%CVE-2025-32026LOWElement Web could load a malicious instance of Element Call leaking media encryption keysEPSS 0.2%CVE-2026-119407HIGHElement Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL ParametersEPSS 0.1%