{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/element-web--1.12.32/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-119407"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Element Web (\u003c 1.12.32)","Element Desktop (\u003c 1.12.32)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Element"],"content_html":"\u003cp\u003eElement Web and Element Desktop versions before 1.12.32 are vulnerable to session manipulation. The \u003ccode\u003eloadSession\u003c/code\u003e function accepts guest credentials (\u003ccode\u003eguest_user_id\u003c/code\u003e and \u003ccode\u003eguest_access_token\u003c/code\u003e) via URL fragment parameters.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eRemote unauthenticated attackers can lure users into opening links containing these parameters to force an attacker-controlled guest session, log out the victim, and destroy unbacked end-to-end encryption keys.\u003c/p\u003e\n","date_modified":"2026-10-30T13:28:57Z","date_published":"2026-10-30T13:28:57Z","id":"https://feed.craftedsignal.io/briefs/2026-10-element-web-session-manipulation/","summary":"Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters, which allows unauthenticated attackers to log out users and clear local stores.","title":"Element Web and Element Desktop: Session manipulation via URL fragment parameters (CVE-2026-119407)","url":"https://feed.craftedsignal.io/briefs/2026-10-element-web-session-manipulation/"}],"language":"en","title":"CraftedSignal Threat Feed - Element Web (\u003c 1.12.32)","version":"https://jsonfeed.org/version/1.1"}