CVE-2026-119407
Received Received - Intake

Element Web and Element Desktop Guest Session Hijacking

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with guest_user_id and guest_access_token to force an attacker-controlled guest session and destroy unbacked end-to-end encryption keys.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119407
EUVD
EUVD-2026-113791

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
element-hq element-web 0
element-hq element-desktop 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Element Web and Element Desktop before version 1.12.32. Attackers can exploit URL fragment parameters to inject guest credentials, forcing users into attacker-controlled guest sessions. This allows remote unauthenticated attackers to log out users and clear local data, including destroying end-to-end encryption keys.

Detection Guidance

Check for unusual guest session activity in Element Web/Desktop logs. Look for loadSession calls with guest_user_id and guest_access_token parameters in URLs. Review network traffic for suspicious guest session initiation requests.

Impact Analysis

If you use Element Web or Desktop before 1.12.32, attackers could trick you into opening malicious links. This could log you out, clear your local data, and destroy encryption keys, potentially exposing past encrypted messages or forcing you to use an insecure session.

Compliance Impact

This vulnerability could violate GDPR or HIPAA by exposing encrypted data or allowing unauthorized access to user sessions. Destruction of encryption keys may also breach data integrity and confidentiality requirements under these regulations.

Mitigation Strategies

Upgrade Element Web and Desktop to version 1.12.32 or later. Disable guest access if not required. Monitor for unauthorized session terminations or data deletions. Review and revoke any suspicious guest tokens.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119407. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart