CVE-2025-32026

LowCVSS 3.8/10Last modified Jun 17, 2026

Description

Element Web is a Matrix web client built using the Matrix React SDK. Element Web, starting from version 1.11.16 up to version 1.11.96, can be configured to load Element Call from an external URL. Under certain conditions, the external page is able to get access to the media encryption keys used for an Element Call call. Version 1.11.97 fixes the problem.

Metrics

CVSS 3.1 3.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-497

Affected software

No affected versions have been published.

Timeline

Published: Apr 8, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-320276.1Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS in specific scenarios where the fallbac CVE-2025-320289.9HAX CMS PHP allows you to manage your microsite universe with PHP backend. Multiple file upload functions within the HAX CMS PHP application CVE-2025-320296.9ts-asn1-der is a collection of utility classes to encode ASN.1 data following DER rule. Incorrect number DER encoding can lead to denial on CVE-2025-32034.3A vulnerability classified as problematic was found in Tenda W18E 16.01.0.11. Affected by this vulnerability is the function formSetAccountL CVE-2025-320307.5Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL endpoint. Prior to 2.10.1, a vulnerabil CVE-2025-320317.5Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL endpoint. Prior to 2.10.1, a vulnerabil CVE-2025-320327.5The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Feder CVE-2025-320337.5The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Feder CVE-2025-320347.5The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Feder CVE-2025-320357.5DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 9.13.2, when uploadin CVE-2025-320366.5DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. The algorithm used to generate CVE-2025-320372.0Improper access control for some Intel(R) PresentMon before version 2.3.1 within Ring 3: User Applications may allow a denial of service. Ne