CVE-2026-119407
Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
0th
Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with guest_user_id and guest_access_token to force an attacker-controlled guest session and destroy unbacked end-to-end encryption keys.
| CWE | CWE-352 |
| Vendor | element-hq |
| Product | element-web |
| Published | Oct 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for element-hq element-web
Be the first to know when new high vulnerabilities affecting element-hq element-web are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
High
Affected Versions
element-hq / element-web
0 < 1.12.32
element-hq / element-desktop
0 < 1.12.32
References
github.com: https://github.com/element-hq/element-web/security/advisories/GHSA-c88w-7h6p-27xr github.com: https://github.com/element-hq/element-web/commit/792453c88a399d570599f5d73b08b40157cd80c0 github.com: https://github.com/element-hq/element-web/blob/v1.12.31/apps/web/src/Lifecycle.ts#L188 github.com: https://github.com/element-hq/element-web/releases/tag/v1.12.32 abraxaslabs.tech: https://abraxaslabs.tech/research/element-fragment-guest github.com: https://github.com/element-hq/element-web vulncheck.com: https://www.vulncheck.com/advisories/element-web-and-element-desktop-before-1.12.32-forced-logout-via-guest-credential-url-parameters
Credits
🔍 Abraxas Labs Michael Telatynski