Live › vulnerability › CVE-2026-119407
Element Web and Element Desktop before 1.12.32 read guest login credentials from URL fragment parameters, so a link can switch a logged-in user into an attacker-controlled guest session. The same flaw lets an attacker clear local stores and destroy end-to-end encryption keys that were not backed up.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Anyone who runs Element Web or Element Desktop before 1.12.32 and is logged in is exposed to crafted links. Teams that only use hosted or managed Element clients still need to confirm the version their users run. Users who have never logged in to Element, or who run a patched build, are not affected.
No product ranges from the sources yet.
1.12.32.1.12.32.1.12.32 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with guest_user_id and guest_access_token to force an attacker-controlled guest session and destroy unbacked end-to-end encryption keys.
This page as .md · .json · in your agent: get_signal("CVE-2026-119407")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.