CVE-2026-119407

Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with guest_user_id and guest_access_token to force an attacker-controlled guest session and destroy unbacked end-to-end encryption keys.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://abraxaslabs.tech/research/element-fragment-guest
https://github.com/element-hq/element-web
https://github.com/element-hq/element-web/blob/v1.12.31/apps/web/src/Lifecycle.ts#L188
https://github.com/element-hq/element-web/commit/792453c88a399d570599f5d73b08b40157cd80c0
https://github.com/element-hq/element-web/releases/tag/v1.12.32
https://github.com/element-hq/element-web/security/advisories/GHSA-c88w-7h6p-27xr
https://www.vulncheck.com/advisories/element-web-and-element-desktop-before-1.12.32-forced-logout-via-guest-credential-url-parameters

Configurations

No configuration.

History

30 Oct 2026, 12:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-30 12:16

Updated : 2026-10-30 19:07

NVD link : CVE-2026-119407

Mitre link : CVE-2026-119407

CVE.ORG link : CVE-2026-119407

JSON object : View

Products Affected

No product.

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2026-119407", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "element-hq", "product": "element-web", "versions": [{"status": "affected", "version": "0", "lessThan": "1.12.32", "versionType": "semver"}, {"status": "unaffected", "version": "1.12.32", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "element-hq", "product": "element-desktop", "versions": [{"status": "affected", "version": "0", "lessThan": "1.12.32", "versionType": "semver"}, {"status": "unaffected", "version": "1.12.32", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-30T12:16:37.120", "references": [{"url": "https://abraxaslabs.tech/research/element-fragment-guest", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/element-hq/element-web", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/element-hq/element-web/blob/v1.12.31/apps/web/src/Lifecycle.ts#L188", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/element-hq/element-web/commit/792453c88a399d570599f5d73b08b40157cd80c0", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/element-hq/element-web/releases/tag/v1.12.32", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/element-hq/element-web/security/advisories/GHSA-c88w-7h6p-27xr", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/element-web-and-element-desktop-before-1.12.32-forced-logout-via-guest-credential-url-parameters", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with guest_user_id and guest_access_token to force an attacker-controlled guest session and destroy unbacked end-to-end encryption keys."}], "lastModified": "2026-10-30T19:07:01.313", "sourceIdentifier": "disclosure@vulncheck.com"}