Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-119407Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters

High 7.1

In plain English

A high-severity cross-site request forgery in element-desktop from element-hq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.1%top 96.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with guest_user_id and guest_access_token to force an attacker-controlled guest session and destroy unbacked end-to-end encryption keys.

Affected products (as reported)

Vendor	Product	Versions
element-hq	element-web	0 – before 1.12.32
element-hq	element-desktop	0 – before 1.12.32

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

References

GitHub Security Advisory (GHSA-c88w-7h6p-27xr) vendor-advisory
https://github.com/element-hq/element-web/commit/792453c88a399d570599f5d73b08b40157cd80c0 patch
https://github.com/element-hq/element-web/blob/v1.12.31/apps/web/src/Lifecycle.ts#L188 technical-description
element-web v1.12.32 Release Notes release-notes
https://abraxaslabs.tech/research/element-fragment-guest third-party-advisory
https://github.com/element-hq/element-web product
VulnCheck Advisory: Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters third-party-advisory