element-web vulnerabilities

CVEs whose affected-version data names the element-web package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-119407High· 7.1

1w ago

Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters

Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users in…

▾ Twilightelement-hq · element-webEPSS 0.14%via CVEORG