element-desktop vulnerabilities

2 known vulnerabilities in element-desktop from Element-hq. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  element-web: Cross-Site Request Forgery

  CVE-2026-119407Oct 30, 2026Element-hq

  Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with g

• 7.0 High severity

  element-desktop: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2024-47771Oct 15, 2024Element-hq

  Element Desktop is a Matrix client for desktop platforms. Element Desktop versions 1.11.70 through 1.11.80 contain a vulnerability which can, under specially crafted conditions, lead to the access token becoming exposed to third parties. At least one vector ha