Element Web and Element Desktop: Session manipulation via URL fragment parameters (CVE-2026-119407)
Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters, which allows unauthenticated attackers to log out users and clear local stores.
CVE search metadata
CVE search record: CVE-2026-119407. Severity: high. CVSS: 7.1. KEV: no. Product: Element Web (< 1.12.32), Element Desktop (< 1.12.32). Brief: Element Web and Element Desktop: Session manipulation via URL fragment parameters (CVE-2026-119407). Brief link: https://feed.craftedsignal.io/briefs/2026-10-element-web-session-manipulation/
Triage facts
Revision 1- Applicability
- Element Web (< 1.12.32), Element Desktop (< 1.12.32)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 30, 13:28 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Element Web and Element Desktop versions before 1.12.32 are vulnerable to session manipulation. The loadSession function accepts guest credentials (guest_user_id and guest_access_token) via URL fragment parameters.
Impact
Remote unauthenticated attackers can lure users into opening links containing these parameters to force an attacker-controlled guest session, log out the victim, and destroy unbacked end-to-end encryption keys.