{"cve":"CVE-2024-47771","nvd":{"published":"2024-10-15T15:15:12.800","modified":"2026-06-17T07:57:43.557","status":"Deferred","description":"Element Desktop is a Matrix client for desktop platforms. Element Desktop versions 1.11.70 through 1.11.80 contain a vulnerability which can, under specially crafted conditions, lead to the access token becoming exposed to third parties. At least one vector has been identified internally, involving malicious widgets, but other vectors may exist. Users are strongly advised to upgrade to version 1.11.81 to remediate the issue. As a workaround, avoid granting permissions to untrusted widgets.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N","score":7.0},"cvss_v3":null,"cwes":["CWE-200"],"references":["https://github.com/element-hq/element-desktop/commit/6c78684e84ba7f460aedba6f017760e2323fdf4b","https://github.com/element-hq/element-desktop/security/advisories/GHSA-963w-49j9-gxj6","https://github.com/element-hq/element-web/commit/63c8550791a0221189f495d6458fee7db601c789"],"products":[],"source":"nvd","synced_at":"2026-10-19T21:55:31.737901711+00:00"},"epss":{"cve":"CVE-2024-47771","score":0.00591,"percentile":0.48283,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}