Element-hq vulnerabilities
We track 11 vulnerabilities in Element-hq products across 8 products. 11 are rated high or critical, and none are known to be exploited. The most recent was published on October 30, 2026.
Latest Element-hq vulnerabilities
- 7.1 High severity
element-web: Cross-Site Request Forgery
Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with g
- 8.6 High severity
element-call: Exposure of Sensitive Information to an Unauthorized Actor
Element Call is a native Matrix video conferencing application. Versions 0.5.17 through 0.19.3 report analytics data to a PostHog server, when configured to by a `posthog` key in config.json or by the `posthogApiHost` and `posthogApiKey` URL parameters. Severa
- 9.2 Critical severity
ess-helm: Same Seed in Pseudo-Random Number Generator (PRNG)
Element Server Suite Community Edition (ESS Community) deploys a Matrix stack using the provided Helm charts and Kubernetes distribution. The ESS Community Helm Chart secrets initialization hook (using matrix-tools container before 0.5.7) is using an insecure
- 8.3 High severity
matrix-authentication-service: Unverified Password Change
MAS (Matrix Authentication Service) is a user management and authentication service for Matrix homeservers, written and maintained by Element. A logic flaw in matrix-authentication-service 0.20.0 through 1.4.0 allows an attacker with access to an authenticated
- 7.5 High severity
Synapse is an open source Matrix homeserver implementation.
Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 from federating with other servers. The vulnerability has been exploited in the wild and has been fixed
- 9.1 Critical severity
synapse: Unrestricted Upload of File with Dangerous Type
Synapse is an open-source Matrix homeserver. In Synapse versions before 1.120.1, enabling the dynamic_thumbnails option or processing a specially crafted request could trigger the decoding and thumbnail generation of uncommon image formats, potentially invokin
- 7.5 High severity
synapse: Allocation of Resources Without Limits or Throttling
Synapse is an open-source Matrix homeserver. In Synapse before 1.120.1, multipart/form-data requests can in certain configurations transiently increase memory consumption beyond expected levels while processing the request, which can be used to amplify denial
- 7.5 High severity
synapse: Allocation of Resources Without Limits or Throttling
Synapse is an open-source Matrix homeserver. Synapse versions before 1.106 are vulnerable to a disk fill attack, where an unauthenticated adversary can induce Synapse to download and cache large amounts of remote media. The default rate limit strategy is insuf
- 7.0 High severity
element-web: Exposure of Sensitive Information to an Unauthorized Actor
Element is a Matrix web client built using the Matrix React SDK. Element Web versions 1.11.70 through 1.11.80 contain a vulnerability which can, under specially crafted conditions, lead to the access token becoming exposed to third parties. At least one vector
- 7.0 High severity
element-desktop: Exposure of Sensitive Information to an Unauthorized Actor
Element Desktop is a Matrix client for desktop platforms. Element Desktop versions 1.11.70 through 1.11.80 contain a vulnerability which can, under specially crafted conditions, lead to the access token becoming exposed to third parties. At least one vector ha
- 7.8 High severity
element-android: Improper Restriction of Communication Channel to Intended Endpoints
Element Android is an Android Matrix Client. Element Android version 1.4.3 through 1.6.10 is vulnerable to intent redirection, allowing a third-party malicious application to start any internal activity by passing some extra parameters. Possible impact include