Vulnerability Description
Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with guest_user_id and guest_access_token to force an attacker-controlled guest session and destroy unbacked end-to-end encryption keys.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://abraxaslabs.tech/research/element-fragment-guest
- https://github.com/element-hq/element-web
- https://github.com/element-hq/element-web/blob/v1.12.31/apps/web/src/Lifecycle.t
- https://github.com/element-hq/element-web/commit/792453c88a399d570599f5d73b08b40
- https://github.com/element-hq/element-web/releases/tag/v1.12.32
- https://github.com/element-hq/element-web/security/advisories/GHSA-c88w-7h6p-27x
- https://www.vulncheck.com/advisories/element-web-and-element-desktop-before-1.12
FAQ
What is CVE-2026-119407?
CVE-2026-119407 is a vulnerability with a CVSS score of 7.1 (HIGH). Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. ...
How severe is CVE-2026-119407?
CVE-2026-119407 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-119407?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.