Description
Element Desktop is a Matrix client for desktop platforms. Element Desktop versions 1.11.70 through 1.11.80 contain a vulnerability which can, under specially crafted conditions, lead to the access token becoming exposed to third parties. At least one vector has been identified internally, involving malicious widgets, but other vectors may exist. Users are strongly advised to upgrade to version 1.11.81 to remediate the issue. As a workaround, avoid granting permissions to untrusted widgets.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| element-hq | element-desktop | >= 1.11.70, < 1.11.81 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | element-web +1 | 1.11.81-1.1 | openSUSE-SU-2024:14407-1, openSUSE-SU-2024:14406-1 |
Advisories 2
- openSUSE-SU-2024:14406-1 element-desktop-1.11.81-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14407-1 element-web-1.11.81-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026