---
id: CVE-2026-119407
title: >-
  Element Web and Element Desktop before 1.12.32 Forced Logout via Guest
  Credential URL Parameters
summary: >-
  Element Web and Element Desktop before 1.12.32 accept guest credentials from
  URL fragment parameters in loadSession, allowing remote unauthenticated
  attackers to log out users and clear local stores. Attackers can lure
  logged-in users in…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H'
cvssSource: cna
cwe:
  - CWE-352
vendor: element-hq
product: element-web
affected:
  - element-web < 1.12.32
  - element-desktop < 1.12.32
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-04T02:08:05.542991Z'
published: '2026-10-30'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T17:35:18.675Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119407'
references:
  - url: >-
      https://github.com/element-hq/element-web/security/advisories/GHSA-c88w-7h6p-27xr
    label: GitHub Security Advisory (GHSA-c88w-7h6p-27xr)
  - url: >-
      https://github.com/element-hq/element-web/commit/792453c88a399d570599f5d73b08b40157cd80c0
  - url: >-
      https://github.com/element-hq/element-web/blob/v1.12.31/apps/web/src/Lifecycle.ts#L188
  - url: 'https://github.com/element-hq/element-web/releases/tag/v1.12.32'
    label: element-web v1.12.32 Release Notes
  - url: 'https://abraxaslabs.tech/research/element-fragment-guest'
  - url: 'https://github.com/element-hq/element-web'
  - url: >-
      https://www.vulncheck.com/advisories/element-web-and-element-desktop-before-1.12.32-forced-logout-via-guest-credential-url-parameters
    label: >-
      VulnCheck Advisory: Element Web and Element Desktop before 1.12.32 Forced
      Logout via Guest Credential URL Parameters
tags:
  - cve.org
epss: 0.00142
epssPercentile: 0.03579
ingestedAt: '2026-11-03T10:42:03.638Z'
---

## Overview

Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with guest_user_id and guest_access_token to force an attacker-controlled guest session and destroy unbacked end-to-end encryption keys.

## Affected

- `element-web < 1.12.32`
- `element-desktop < 1.12.32`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.