CVE-2025-59161

Element Web is a Matrix web client built using the Matrix React SDK. Element Web and Element Desktop before version 1.11.112 have insufficient validation of room predecessor links, allowing a remote attacker to attempt to impermanently replace a room's entry in the room list with an unrelated attacker-supplied room. While the effect of this is temporary, it may still confuse users into acting on incorrect assumptions. The issue has been patched and users should upgrade to 1.11.112. A reload/refresh will fix the incorrect room list state, removing the attacker's room and restoring the original room.

CVSS

No CVSS.

References

Link	Resource
https://github.com/element-hq/element-web/commit/8e9a43d70c90e6a3b110cd0a377296079e4c81f5
https://github.com/element-hq/element-web/security/advisories/GHSA-m6c8-98f4-75rr

Configurations

No configuration.

History

01 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) Element Web es un cliente web de Matrix construido usando el SDK de React de Matrix. Element Web y Element Desktop antes de la versión 1.11.112 tienen una validación insuficiente de los enlaces predecesores de sala, permitiendo a un atacante remoto intentar reemplazar de forma impermanente la entrada de una sala en la lista de salas con una sala no relacionada proporcionada por el atacante. Aunque el efecto de esto es temporal, aún puede confundir a los usuarios llevándolos a actuar basándose en suposiciones incorrectas. El problema ha sido parcheado y los usuarios deberían actualizar a la versión 1.11.112. Una recarga/actualización corregirá el estado incorrecto de la lista de salas, eliminando la sala del atacante y restaurando la sala original.

Information

Published : 2025-09-16 17:15

Updated : 2026-10-01 16:10

NVD link : CVE-2025-59161

Mitre link : CVE-2025-59161

CVE.ORG link : CVE-2025-59161

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2025-59161", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59161", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-16T17:29:24.810855Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "element-hq", "product": "element-web", "versions": [{"status": "affected", "version": "< 1.11.112"}]}]}], "published": "2025-09-16T17:15:41.747", "references": [{"url": "https://github.com/element-hq/element-web/commit/8e9a43d70c90e6a3b110cd0a377296079e4c81f5", "source": "security-advisories@github.com"}, {"url": "https://github.com/element-hq/element-web/security/advisories/GHSA-m6c8-98f4-75rr", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Element Web is a Matrix web client built using the Matrix React SDK. Element Web and Element Desktop before version 1.11.112 have insufficient validation of room predecessor links, allowing a remote attacker to attempt to impermanently replace a room's entry in the room list with an unrelated attacker-supplied room. While the effect of this is temporary, it may still confuse users into acting on incorrect assumptions. The issue has been patched and users should upgrade to 1.11.112. A reload/refresh will fix the incorrect room list state, removing the attacker's room and restoring the original room."}, {"lang": "es", "value": "Element Web es un cliente web de Matrix construido usando el SDK de React de Matrix. Element Web y Element Desktop antes de la versi\u00f3n 1.11.112 tienen una validaci\u00f3n insuficiente de los enlaces predecesores de sala, permitiendo a un atacante remoto intentar reemplazar de forma impermanente la entrada de una sala en la lista de salas con una sala no relacionada proporcionada por el atacante. Aunque el efecto de esto es temporal, a\u00fan puede confundir a los usuarios llev\u00e1ndolos a actuar bas\u00e1ndose en suposiciones incorrectas. El problema ha sido parcheado y los usuarios deber\u00edan actualizar a la versi\u00f3n 1.11.112. Una recarga/actualizaci\u00f3n corregir\u00e1 el estado incorrecto de la lista de salas, eliminando la sala del atacante y restaurando la sala original."}], "lastModified": "2026-10-01T16:10:00.257", "sourceIdentifier": "security-advisories@github.com"}