{"id":"CVE-2026-119407","kind":"vulnerability","aliases":["CVE-2026-119407"],"related":[],"title":"Element Web and Desktop: crafted links log users out and wipe local keys","description":"Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with guest_user_id and guest_access_token to force an attacker-controlled guest session and destroy unbacked end-to-end encryption keys.","summary":"Element Web and Element Desktop before 1.12.32 read guest login credentials from URL fragment parameters, so a link can switch a logged-in user into an attacker-controlled guest session. The same flaw lets an attacker clear local stores and destroy end-to-end encryption keys that were not backed up.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["element","element-desktop","element-web","end-to-end-encryption","matrix","package"],"not_affected_if":["not-logged-in","patched-version"],"how_to_check":"- Check the installed Element Web or Element Desktop version against `1.12.32`.\n- Open the app's about or version screen and confirm the build number is at least `1.12.32`.","fix":"- Element Web and Element Desktop: upgrade to `1.12.32` or later.","status":"open","published_at":"2026-10-30T12:16:37+00:00","first_seen_at":"2026-10-30T12:30:23+00:00","triaged_at":"2026-10-30T12:32:27+00:00","updated_at":"2026-10-30T12:32:27+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T12:32:27Z","model":"claude-haiku-5-5","output":{"fix":"- Element Web and Element Desktop: upgrade to `1.12.32` or later.","reach":"internet","title":"Element Web and Desktop: crafted links log users out and wipe local keys","impact":"medium","summary":"Element Web and Element Desktop before 1.12.32 read guest login credentials from URL fragment parameters, so a link can switch a logged-in user into an attacker-controlled guest session. The same flaw lets an attacker clear local stores and destroy end-to-end encryption keys that were not backed up.","audience":"everyone","category":"package","nicknames":[],"who_cares":["element","element-web","element-desktop","matrix","end-to-end-encryption"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Session logged out, local stores cleared, unbacked encryption keys destroyed","analyst_note":"","how_to_check":"- Check the installed Element Web or Element Desktop version against `1.12.32`.\n- Open the app's about or version screen and confirm the build number is at least `1.12.32`.","plain_action":"Update Element Web or Element Desktop to version 1.12.32 or later, and do not open unexpected Element links until you have.","needs_analyst":false,"not_affected_if":["patched-version","not-logged-in"],"who_is_affected":"Anyone who runs Element Web or Element Desktop before 1.12.32 and is logged in is exposed to crafted links. Teams that only use hosted or managed Element clients still need to confirm the version their users run. Users who have never logged in to Element, or who run a patched build, are not affected.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000709,"input_tokens":4157,"output_tokens":587,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119407':16A,19A '-2026':15A,18A '1.12.32':40B,93C 'accept':94C 'access':131C 'allow':103C 'attack':62B,71B,106C,115C,137C 'attacker-control':61B,136C 'back':86B 'clear':72B,112C 'control':63B,138C 'craft':5A 'credenti':44B,96C 'cve':14A,17A 'desktop':4A,23B,38B,91C 'destroy':76B,142C 'element':1A,20B,22B,25B,34B,37B,87C,90C 'element-desktop':21B 'element-web':24B 'encrypt':31B,81B,148C 'end':28B,30B,78B,80B,145C,147C 'end-to-end':77B,144C 'end-to-end-encrypt':27B 'flaw':68B 'forc':134C 'fragment':47B,99C 'guest':42B,64B,95C,126C,130C,139C 'id':128C 'key':13A,82B,149C 'let':69B 'link':6A,51B,124C 'loadsess':102C 'local':12A,73B,113C 'log':7A,56B,108C,119C 'logged-in':55B,118C 'login':43B 'lure':117C 'matrix':32B 'open':123C 'packag':33B 'paramet':48B,100C 'read':41B 'remot':104C 'session':65B,140C 'store':74B,114C 'switch':53B 'token':132C 'unauthent':105C 'unback':143C 'url':46B,98C 'user':8A,58B,110C,121C,127C 'web':2A,26B,35B,88C 'wipe':11A","nicknames":[],"mitigations":[],"who_affected":"Anyone who runs Element Web or Element Desktop before 1.12.32 and is logged in is exposed to crafted links. Teams that only use hosted or managed Element clients still need to confirm the version their users run. Users who have never logged in to Element, or who run a patched build, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Element Web or Element Desktop to version 1.12.32 or later, and do not open unexpected Element links until you have.","first_public_at":"2026-10-30T12:16:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119407","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119407","severity":null,"published_at":"2026-10-30T12:16:37+00:00","modified_at":"2026-10-30T12:16:37+00:00","first_seen_at":"2026-10-30T12:30:23+00:00","fetched_at":"2026-10-30T12:30:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}