CVE-2025-59161

LowCVSS 2.7

Published: 16/09/2025(UTC)Updated: 01/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.41%

33th percentile - higher than 33% of all known CVEs

Summary

Element Web and Element Desktop before version 1.11.112 have insufficient validation of room predecessor links, allowing a remote attacker to attempt to impermanently replace a room's entry in the room list with an unrelated attacker-supplied room. While the effect is temporary, it may confuse users into acting on incorrect assumptions. The issue has been patched and users should upgrade to 1.11.112.

Risk Assessment

The attack can temporarily replace a room on the list, potentially misleading users and leading to actions based on incorrect data. After reload, the list state returns to normal.

Recommendation

Update Element Web and Element Desktop to version 1.11.112 or later. If the issue occurs, reloading the page will restore the correct room list state.

Other vulnerabilities in Element Web

CVE-2026-55850Medium
In Element Web before 1.12.22, EmbeddedPage in apps/web/src/components/structures/EmbeddedPage.tsx renders homeserver-supplied homepage content through dangerouslySetInnerHTML without passing it through sanitizedHtmlNode. A malicious homeserver can provide crafted HTML that Element Web renders on the homepage; the content security policy prevents JavaScript but not phishing HTML.

Original NVD description (English source)

Element Web is a Matrix web client built using the Matrix React SDK. Element Web and Element Desktop before version 1.11.112 have insufficient validation of room predecessor links, allowing a remote attacker to attempt to impermanently replace a room's entry in the room list with an unrelated attacker-supplied room. While the effect of this is temporary, it may still confuse users into acting on incorrect assumptions. The issue has been patched and users should upgrade to 1.11.112. A reload/refresh will fix the incorrect room list state, removing the attacker's room and restoring the original room.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS