CVE-2026-119407: Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters

Published Oct 30, 2026

Updated

Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with guestuserid and guestaccesstoken to force an attacker-controlled guest session and destroy unbacked end-to-end encryption keys.

Event History

Oct 30, 2026

CVE Published

via MITRE·11:30 AM

Data Sourced

via MITRE·11:30 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Users of Element Web and Element Desktop versions before 1.12.32 are exposed if they are logged in and can be lured into opening a crafted link. The attack is performed remotely without attacker authentication.

What must an attacker do to trigger the impact?

The attacker must persuade a logged-in user to open a URL containing guest_user_id and guest_access_token fragment parameters. This causes the client to load an attacker-controlled guest session, log the user out, and clear local stores.

What data or functionality may be lost?

The attack can clear local stores and destroy end-to-end encryption keys that have not been backed up. This can cause availability impact and loss of access to encrypted content associated with those unbacked keys.

How can I determine whether a deployment is affected?

Check the Element Web or Element Desktop version in use. Versions before 1.12.32 are affected; the provided information does not identify any configuration prerequisite beyond a logged-in user opening a crafted link.

CVE-2026-119407: Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters

Event History

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to trigger the impact?

What data or functionality may be lost?

How can I determine whether a deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to trigger the impact?

What data or functionality may be lost?

How can I determine whether a deployment is affected?