Element Web (< 1.12.32) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/element-web--1.12.32/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 13:28:57 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgElement Web and Element Desktop: Session manipulation via URL fragment parameters (CVE-2026-119407)https://feed.craftedsignal.io/briefs/2026-10-element-web-session-manipulation/Fri, 30 Oct 2026 13:28:57 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-element-web-session-manipulation/Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters, which allows unauthenticated attackers to log out users and clear local stores.Element Web and Element Desktop versions before 1.12.32 are vulnerable to session manipulation. The loadSession function accepts guest credentials (guest_user_id and guest_access_token) via URL fragment parameters.

Impact

Remote unauthenticated attackers can lure users into opening links containing these parameters to force an attacker-controlled guest session, log out the victim, and destroy unbacked end-to-end encryption keys.

]]>highadvisory