What’s Vulnerable › Vulnerabilities

CVE-2026-119407: Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-30 · updated 2026-10-30
• Weakness: CWE-352

Description

Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with guest_user_id and guest_access_token to force an attacker-controlled guest session and destroy unbacked end-to-end encryption keys.

Affected products

• element-hq element-desktop: before 1.12.32 — fixed in 1.12.32
• element-hq element-web: before 1.12.32 — fixed in 1.12.32

How to fix

Upgrade to a fixed version: element-hq element-desktop 1.12.32; element-hq element-web 1.12.32. Check the vendor advisory for mitigations.

References

• https://abraxaslabs.tech/research/element-fragment-guest
• https://github.com/element-hq/element-web
• https://github.com/element-hq/element-web/blob/v1.12.31/apps/web/src/Lifecycle.ts#L188
• https://github.com/element-hq/element-web/commit/792453c88a399d570599f5d73b08b40157cd80c0
• https://github.com/element-hq/element-web/releases/tag/v1.12.32
• https://github.com/element-hq/element-web/security/advisories/GHSA-c88w-7h6p-27xr
• https://www.vulncheck.com/advisories/element-web-and-element-desktop-before-1.12.32-forced-logout-via-guest-credential-url-parameters

Get alerted when CVE-2026-119407 or the next vulnerability affects your stack