CVE-2025-59161
BaseFortify
Publication date: 2025-09-16
Last updated on: 2025-09-17
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| element | element_web | 1.11.112 |
| element | element_desktop | 1.11.112 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Element Web and Element Desktop (before version 1.11.112) involves insufficient validation of room predecessor links. A remote attacker can temporarily replace a legitimate room's entry in a user's room list with an unrelated attacker-supplied room. Although this replacement is temporary and can be fixed by reloading the application, it may confuse users into acting on incorrect assumptions about which room they are interacting with. [1]
How can this vulnerability impact me? :
The vulnerability can cause confusion by temporarily showing an attacker-supplied room in place of a legitimate room in the user's room list. This may lead users to mistakenly interact with the wrong room, potentially causing them to disclose information or take actions based on incorrect room context. However, the effect is impermanent and can be resolved by refreshing the application, which restores the correct room list. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by observing if the room list in Element Web or Element Desktop temporarily shows an unrelated attacker-supplied room replacing a legitimate room. Since the issue involves insufficient validation of room predecessor links causing temporary incorrect room list entries, detection involves monitoring the client UI for unexpected room replacements. There are no specific network or system commands provided to detect this vulnerability directly. A practical approach is to refresh or reload the application to see if the room list state corrects itself, indicating the presence of the issue. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading Element Web and Element Desktop to version 1.11.112 or later, where the vulnerability has been patched. As a temporary workaround, users can reload or refresh the application to restore the correct room list state, which removes the attacker-supplied room and reinstates the original room. These steps help prevent confusion caused by the temporary replacement of legitimate rooms. [1]