CVE-2026-119407
High
Description
Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with guest_user_id and guest_access_token to force an attacker-controlled guest session and destroy unbacked end-to-end encryption keys.
SeverityHigh
CVSS7.1
Exploit probability—
ProductElement-hq Element-web
PublishedOct 30, 2026
First seenNov 4, 2026
Weakness typeCWE-352Cross-site request forgery (CSRF)
How to fix
Update
- element-hq element-web1.12.32 or later
- element-hq element-desktop1.12.32 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| element-hq element-web | v < 1.12.32 | 1.12.32 |
| element-hq element-desktop | v < 1.12.32 | 1.12.32 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.