Riskcovery

CVE-2025-31126

Element X iOS allows the entity in control of the well-known file to break the confidentiality of embedded Element Call

State
Published
Severity
5.3 Medium
Published
Apr 3, 2025
Updated
Apr 7, 2025
Reserved
Mar 26, 2025

Read the record on cve.org

Description

Element X iOS is a Matrix iOS Client provided by Element. In Element X iOS version between 1.6.13 and 25.03.7, the entity in control of the element.json well-known file is able, under certain conditions, to get access to the media encryption keys used for an Element Call call. This vulnerability is fixed in 25.03.8.

Scores

CVSSScoreVectorSource
3.15.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NGitHub_M

Weaknesses

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

ProductVersions
element-x-ioselement-hq
  • >= 1.6.13, < 25.03.8Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.