CVE-2026-119407 | BDVDB-2026-398481 Detail
element-hqelement-web
Description#
Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with guest_user_id and guest_access_token to force an attacker-controlled guest session and destroy unbacked end-to-end encryption keys.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact low, availability impact high. Attack vector: network.
Weaknesses#
- CWE-352 Cross-Site Request Forgery (CSRF)
References#
- https://github.com/element-hq/element-web/security/advisories/GHSA-c88w-7h6p-27xr
- https://github.com/element-hq/element-web/commit/792453c88a399d570599f5d73b08b40157cd80c0
- https://github.com/element-hq/element-web/blob/v1.12.31/apps/web/src/Lifecycle.ts#L188
- https://github.com/element-hq/element-web/releases/tag/v1.12.32
- https://abraxaslabs.tech/research/element-fragment-guest
- https://github.com/element-hq/element-web
- https://www.vulncheck.com/advisories/element-web-and-element-desktop-before-1.12.32-forced-logout-via-guest-credential-url-parameters
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.