CVE-2025-59161 Business logic in element-web
A malicious Matrix room can temporarily hide or replace another room in the client list, potentially confusing users into acting on incorrect information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-59161?
CVE-2025-59161 is a low-severity vulnerability in element-hq element-web, published on 16 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Element Web is a Matrix web client built using the Matrix React SDK. Element Web and Element Desktop before version 1.11.112 have insufficient validation of room predecessor links, allowing a remote attacker to attempt to impermanently replace a room's entry in the room list with an unrelated attacker-supplied room. While the effect of this is temporary, it may still confuse users into acting on incorrect assumptions. The issue has been patched and users should upgrade to 1.11.112. A reload/refresh will fix the incorrect room list state, removing the attacker's room and restoring the original room.
Weakness: CWE-20
Which versions are affected by CVE-2025-59161?
Linux distribution packages (2)
element-desktop openSUSE:Tumbleweed | All versions | 1.11.112-1.1 |
element-web openSUSE:Tumbleweed | All versions | 1.11.112-1.1 |
How do I fix CVE-2025-59161?
Upgrade to a fixed version.
Is CVE-2025-59161 being exploited?
There is no known exploitation of CVE-2025-59161 in the wild and no public exploit code.
Sources
Also known as GHSA-m6c8-98f4-75rr, openSUSE-SU-2025:15558-1, openSUSE-SU-2025:15559-1.