---
id: "CVE-2026-119407"
kind: "vulnerability"
aliases: ["CVE-2026-119407"]
title: "Element Web and Desktop: crafted links log users out and wipe local keys"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["element", "element-desktop", "element-web", "end-to-end-encryption", "matrix", "package"]
not_affected_if: ["not-logged-in", "patched-version"]
published_at: "2026-10-30T12:16:37+00:00"
first_seen_at: "2026-10-30T12:30:23+00:00"
updated_at: "2026-10-30T12:32:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119407", "first_seen_at": "2026-10-30T12:30:23+00:00"}]
---

# Element Web and Desktop: crafted links log users out and wipe local keys

Element Web and Element Desktop before 1.12.32 read guest login credentials from URL fragment parameters, so a link can switch a logged-in user into an attacker-controlled guest session. The same flaw lets an attacker clear local stores and destroy end-to-end encryption keys that were not backed up.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Element Web or Element Desktop version against `1.12.32`.
- Open the app's about or version screen and confirm the build number is at least `1.12.32`.

## Fix

- Element Web and Element Desktop: upgrade to `1.12.32` or later.

## Timeline

- 2026-10-30T12:30:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119407

## From the sources

Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with guest_user_id and guest_access_token to force an attacker-controlled guest session and destroy unbacked end-to-end encryption keys.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_