PT-2025-15454 · Matrix · Element Web

Published 2025-04-08 · Updated 2025-04-08 · CVE-2025-32026

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Element Web versions 1.11.16 through 1.11.96

Description: The issue concerns Element Web, a Matrix web client, where versions from 1.11.16 to 1.11.96 can be configured to load Element Call from an external URL. Under certain conditions, this external page can gain access to the media encryption keys used for an Element Call.

Recommendations: For versions 1.11.16 through 1.11.96, update to version 1.11.97 to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-497

Related Identifiers

CVE-2025-32026

GHSA-69Q3-JG79-CG79

Affected Products

Element Web

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32026.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-32026 · Security Note
• https://osv.dev/vulnerability/CVE-2025-32026 · Vendor Advisory
• https://github.com/element-hq/element-web/security/advisories/GHSA-69q3-jg79-cg79 · Note
• https://twitter.com/CVEnew/status/1909631345023660212 · Twitter Post