CVE-2025-32026 LOW

CVE-2025-32026: Element Web could load a malicious instance of Element Call leaking media encryption keys

Vendor Element-Hq
Product element-web
Weakness CWE-497
Published April 8, 2025
Last update April 8, 2025
View on NVD All CVEs

CVSS base score

3.8/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

Element Web is a Matrix web client built using the Matrix React SDK. Element Web, starting from version 1.11.16 up to version 1.11.96, can be configured to load Element Call from an external URL. Under certain conditions, the external page is able to get access to the media encryption keys used for an Element Call call. Version 1.11.97 fixes the problem.

Key dates

02Disclosure timeline

April 8, 2025 CVE published
April 8, 2025 Record updated