Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-119407— Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters

Quick assessment

Affected
element-hq element-web
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 1.12.32 版本之前的 Element Web 和 Element Desktop 中，loadSession 函数会接受来自 URL 片段参数（fragment parameters）的访客凭证，这使得远程未认证攻击者能够强制用户登出并清除本地存储。攻击者可以诱骗已登录用户打开包含 guest_user_id 和 guest_access_token 的链接，从而强制建立由攻击者控制的访客会话，并销毁未备份的端到端加密密钥。

CVSS 7.1 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-119407

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters
Source: CVE Program / CVE List V5
Vulnerability Description
Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with guest_user_id and guest_access_token to force an attacker-controlled guest session and destroy unbacked end-to-end encryption keys.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
element-hq element-web 0 ~ 1.12.32 -
element-hq element-desktop 0 ~ 1.12.32 -

II. Public POCs for CVE-2026-119407

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-119407

请登录查看更多情报信息。

Other References for CVE-2026-119407 (7)

IV. Related Vulnerabilities

Same product: element-web
Same vendor: element-hq
Same weakness: CWE-352