CVE-2026-119407

    Dashboard / Vulnerabilities / CVE-2026-119407

    CVE-2026-119407

    Published: 30 Oct 2026Last Modified: 7 Nov 2026

    Summary: Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters

    Details: Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with guest_user_id and guest_access_token to force an attacker-controlled guest session and destroy unbacked end-to-end encryption keys.

    References: https://abraxaslabs.tech/research/element-fragment-guest, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119407.json, https://github.com/element-hq/element-web/releases/tag/v1.12.32, https://github.com/element-hq/element-web/security/advisories/GHSA-c88w-7h6p-27xr, https://nvd.nist.gov/vuln/detail/CVE-2026-119407, https://www.vulncheck.com/advisories/element-web-and-element-desktop-before-1.12.32-forced-logout-via-guest-credential-url-parameters, https://github.com/element-hq/element-web/commit/792453c88a399d570599f5d73b08b40157cd80c0, https://github.com/element-hq/element-web, https://github.com/element-hq/element-web/blob/v1.12.31/apps/web/src/Lifecycle.ts#L188

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -ed0a1239e8531243f479529a056872da7889e248

    Affected versions

    v1.12.31
    v1.12.31-rc.1
    v1.12.31-rc.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-119407 | CVE-DB