CVE-2026-119407
Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters
- State
- Published
- Severity
- 7.1 High
- Published
- Oct 30, 2026
- Updated
- Oct 30, 2026
- Reserved
- Oct 30, 2026
Description
Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with guest_user_id and guest_access_token to force an attacker-controlled guest session and destroy unbacked end-to-end encryption keys.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.1 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H | VulnCheck |
Weaknesses
- CWE-352 Cross-Site Request Forgery (CSRF)
Affected Products
| Product | Versions |
|---|---|
element-webelement-hq |
|
element-desktopelement-hq |
|
References
- GitHub Security Advisory (GHSA-c88w-7h6p-27xr)vendor-advisory
- https://github.com/element-hq/element-web/commit/792453c88a399d570599f5d73b08b40157cd80c0patch
- https://github.com/element-hq/element-web/blob/v1.12.31/apps/web/src/Lifecycle.ts#L188technical-description
- element-web v1.12.32 Release Notesrelease-notes
- https://abraxaslabs.tech/research/element-fragment-guestthird-party-advisory
- https://github.com/element-hq/element-webproduct
- VulnCheck Advisory: Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parametersthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.