CVE-2024-47771
Element Desktop vulnerable to potential exposure of access token via authenticated media
Element Desktop is a Matrix client for desktop platforms. Element Desktop versions 1.11.70 through 1.11.80 contain a vulnerability which can, under specially crafted conditions, lead to the access token becoming exposed to third parties. At least one vector has been identified internally, involving malicious widgets, but other vectors may exist. Users are strongly advised to upgrade to version 1.11.81 to remediate the issue. As a workaround, avoid granting permissions to untrusted widgets.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Element Desktop vulnerable to potential exposure of access token via authenticated media
Element Desktop is a Matrix client for desktop platforms. Element Desktop versions 1.11.70 through 1.11.80 contain a vulnerability which can, under specially crafted conditions, lead to the access token becoming exposed to third parties. At least one vector has been identified internally, involving malicious widgets, but other vectors may exist. Users are strongly advised to upgrade to version 1.11.81 to remediate the issue. As a workaround, avoid granting permissions to untrusted widgets.
- Record
CVE-2024-47771- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2024-42681
Element Desktop is a Matrix client for desktop platforms. Element Desktop versions 1.11.70 through 1.11.80 contain a vulnerability which can, under specially crafted conditions, lead to the access token becoming exposed to third parties. At least one vector has been identified internally, involving malicious widgets, but other vectors may exist. Users are strongly advised to upgrade to version 1.11.81 to remediate the issue. As a workaround, avoid granting permissions to untrusted widgets.
- Record
EUVD-2024-42681- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-03
NVD
Element Desktop is a Matrix client for desktop platforms. Element Desktop versions 1.11.70 through 1.11.80 contain a vulnerability which can, under specially crafted conditions, lead to the access token becoming exposed to third parties. At least one vector has been identified internally, involving malicious widgets, but other vectors may exist. Users are strongly advised to upgrade to version 1.11.81 to remediate the issue. As a workaround, avoid granting permissions to untrusted widgets.
- Record
CVE-2024-47771- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
Element Desktop vulnerable to potential exposure of access token via authenticated media
Element Desktop is a Matrix client for desktop platforms. Element Desktop versions 1.11.70 through 1.11.80 contain a vulnerability which can, under specially crafted conditions, lead to the access token becoming exposed to third parties. At least one vector has been identified internally, involving malicious widgets, but other vectors may exist. Users are strongly advised to upgrade to version 1.11.81 to remediate the issue. As a workaround, avoid granting permissions to untrusted widgets.
- Record
CVE-2024-47771- CVSS 4.0
- 7.0 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14406-1 No score
element-desktop-1.11.81-1.1 on GA media
These are all security issues fixed in the element-desktop-1.11.81-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14406-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14407-1 No score
element-web-1.11.81-1.1 on GA media
These are all security issues fixed in the element-web-1.11.81-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14407-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
element-desktopopenSUSE:Tumbleweed |
before 1.11.81-1.1 | 1.11.81-1.1 |
element-webopenSUSE:Tumbleweed |
before 1.11.81-1.1 | 1.11.81-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-47771 is a high vulnerability (CVSS 7.0) in Element-hq Element-desktop, published October 15, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.59%, the 48th percentile. Fixed in element-desktop 1.11.81-1.1.
References
github.com/element-hq/element-desktop/security/advisories/GHSA-963w-49j9-gxj6
nvd.nist.gov/vuln/detail/CVE-2024-47771
lists.opensuse.org/archives/list/[email protected]/thread/KQNDUBJFHLJVEPUM4DHLDV6T3EUECFA7
suse.com/security/cve/CVE-2024-47771