Skip to content

A malicious room can hide an unrelated room and cause it to be left when the malicious room is left

Moderate
davidegirardi published GHSA-m6c8-98f4-75rr Sep 16, 2025

Package

Element Desktop

Affected versions

<= 1.11.111

Patched versions

1.11.112
Element Web
<= 1.11.111
1.11.112

Description

Impact

Element Web and Element Desktop before version 1.11.112 have insufficient validation of room predecessor links, allowing a remote attacker to attempt to impermanently replace a room's entry in the room list with an unrelated attacker-supplied room. While the effect of this is temporary, it may still confuse users into acting on incorrect assumptions.

Patches

The issue has been patched and users should upgrade to 1.11.112.

Workarounds

A reload/refresh will fix the incorrect room list state, removing the attacker's room and restoring the original room.

Severity

Moderate

CVE ID

CVE-2025-59161

Weaknesses

No CWEs