CVE-2025-32026 Element Web could load a malicious instance of Element Call leaking media encryption keys
Attackers can leak media encryption keys if Element Web is configured to load Element Call from a malicious external URL.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-32026?
CVE-2025-32026 is a low-severity vulnerability in element-hq element-web, published on 8 Apr 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Element Web is a Matrix web client built using the Matrix React SDK. Element Web, starting from version 1.11.16 up to version 1.11.96, can be configured to load Element Call from an external URL. Under certain conditions, the external page is able to get access to the media encryption keys used for an Element Call call. Version 1.11.97 fixes the problem.
Weakness: CWE-497
Which versions are affected by CVE-2025-32026?
How do I fix CVE-2025-32026?
No fix has been published for CVE-2025-32026 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-32026 being exploited?
There is no known exploitation of CVE-2025-32026 in the wild and no public exploit code.
Sources
Also known as GHSA-69q3-jg79-cg79.