Vulnerabilities

TI-2026-83420 CVE-2026-62347

Element Call exposes shared passwords in logs

LOW 32

Element Call is a native Matrix video conferencing application.

CVSS 4.0MEDIUM 5.9 Network No auth User interaction EPSS 0.00304 Published 2026-10-30 Fixed in 0.20.3 CWE-532

TI-2026-82990 CVE-2026-119407 · GHSA-fm3q-8qwm-p5xr

Forced logout in Element Web and Desktop via URL guest credentials

LOW 30

Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00142 Published 2026-10-30 Fixed in 1.12.32 CWE-352

TI-2026-76542 CVE-2026-55644

Element X iOS deeplink grants mic and camera to attacker origin

LOW 23

Element X iOS is a Matrix iOS Client provided by Element.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.0038 Published 2026-10-19 Fixed in 26.05.0 CWE-20

TI-2026-40312 CVE-2026-55850

Element Web: A malicious homeserver can inject HTML in Element Web using its homepage

LOW 25

Element Web is a Matrix web client built using the Matrix React SDK.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00547 Published 2026-08-21 Fixed in 1.12.22 CWE-79

TI-2026-35452 CVE-2026-48007 · GHSA-6vhh-4xw6-h2h2

Element Call reports full URLs of visited pages to analytics server

LOW 39

Element Call is a native Matrix video conferencing application.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00254 Published 2026-08-07 Fixed in 0.19.4 CWE-200

TI-2026-32926 CVE-2026-45078 · GHSA-8q93-326v-3m7g

Synapse CPU starvation (Denial of Service)

LOW 29

Synapse is an open source Matrix homeserver implementation.

CVSS 4.0MEDIUM 6.8 Local Low privileges No interaction EPSS 0.00128 Published 2026-05-28 Fixed in 1.152.1 CWE-770

TI-2026-32924 CVE-2026-45076 · GHSA-6qf2-7x63-mm6v

Synapse pagination denial of service

LOW 23

Synapse is an open source Matrix homeserver implementation.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00369 Published 2026-05-28 Fixed in 1.152.1 CWE-20

TI-2026-19372 CVE-2026-24044

ESS Community Helm Chart has a weak server key generation method

MEDIUM 42

Element Server Suite Community Edition (ESS Community) deploys a Matrix stack using the provided Helm charts and Kubernetes distribution.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00322 Published 2026-02-12 Fixed in 25.12.1, 0.5.7 CWE-336

TI-2025-38692 CVE-2025-62425

Matrix Authentication Service account password can be changed using an authenticated…

LOW 36

MAS (Matrix Authentication Service) is a user management and authentication service for Matrix homeservers, written and maintained by Element.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00459 Published 2025-10-16 No fix listed CWE-620

TI-2025-38104 CVE-2025-61672 · GHSA-fh66-fcv5-jjfr

Synapse: Invalid device keys degrade federation functionality

LOW 25

Synapse is an open source Matrix homeserver implementation.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00476 Published 2025-10-08 Fixed in 1.138.3, 1.139.1 CWE-1287

TI-2025-36765 CVE-2025-59161

Improper input validation in element-hq element-web

LOW 20

Element Web is a Matrix web client built using the Matrix React SDK.

CVSS 4.0LOW 2.7 Network No auth No interaction EPSS 0.00407 Published 2025-09-16 Fixed in 1.11.112 CWE-20

TI-2025-20409 CVE-2025-27599

Element X Android vulnerable to loading malicious web pages via received intent

LOW 35

Element X Android is a Matrix Android Client provided by element.io.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00367 Published 2025-04-18 Fixed in 25.04.2 CWE-20

TI-2025-23150 CVE-2025-32026

Element Web could load a malicious instance of Element Call leaking media encryption keys

LOW 17

Element Web is a Matrix web client built using the Matrix React SDK.

CVSS 3.1LOW 3.8 Network High privileges No interaction EPSS 0.00166 Published 2025-04-08 Fixed in 1.11.97 CWE-497

TI-2025-22387 CVE-2025-31126

Element X iOS allows the entity in control of the well-known file to break the confidentiality of embedded Element Call

LOW 29

Element X iOS is a Matrix iOS Client provided by Element.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00204 Published 2025-04-03 Fixed in 25.03.8 CWE-200

TI-2025-22388 CVE-2025-31127

Element X Android allows the entity in control of the well-known file to break the confidentiality embedded Element Call

LOW 29

Element X Android is a Matrix Android Client provided by element.io.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00204 Published 2025-04-03 Fixed in 25.03.4 CWE-200

TI-2025-21661 CVE-2025-30355 · GHSA-v56r-hwv5-mxg6

Synapse vulnerable to federation denial of service via malformed events

LOW 35

Synapse is an open source Matrix homeserver implementation.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01226 Published 2025-03-27 Fixed in 1.127.1 CWE-20

TI-2025-20415 CVE-2025-27606

Element Android PIN autologout bypass

LOW 22

Element Android is an Android Matrix Client provided by Element.

CVSS 3.1MEDIUM 5.1 Local No auth No interaction EPSS 0.00191 Published 2025-03-14 Fixed in 1.6.34 CWE-488

TI-2024-24815 CVE-2024-37303 · GHSA-gjgr-7834-rhxr