element-web vulnerabilities

2 known vulnerabilities in element-web from Element-hq. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  element-web: Cross-Site Request Forgery

  CVE-2026-119407Oct 30, 2026Element-hq

  Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with g

• 7.0 High severity

  element-web: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2024-47779Oct 15, 2024Element-hq

  Element is a Matrix web client built using the Matrix React SDK. Element Web versions 1.11.70 through 1.11.80 contain a vulnerability which can, under specially crafted conditions, lead to the access token becoming exposed to third parties. At least one vector