Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters
Element Web and Element Desktop 1.12.31 and earlier are affected when a link containing guest_user_id and guest_access_token parameters opens in the client. Fixed in 1.12.32.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 1.12.32
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Element Web and Element Desktop, the Matrix chat clients, are affected. An attacker can trick a logged-in user into opening a crafted link that logs them out, clears local data, and may destroy encryption keys that were not backed up.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with guest_user_id and guest_access_token to force an attacker-controlled guest session and destroy unbacked end-to-end encryption keys.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- element-hq element-web
fixed in 1.12.32
- element-hq element-desktop
fixed in 1.12.32
References 7
GitHub · element-hq/element-web
abraxaslabs.tech
Questions about CVE-2026-119407
What does this mean?
Opening a link that contains guest_user_id and guest_access_token parameters logs out a previously logged-in user instantly and clears the local stores. This can cause loss of end-to-end-encrypted message data and of the user's digital identity if secure backup is not enabled.Source: github.com
Am I affected, and how do I check?
Element Web and Element Desktop version 1.12.31 or earlier are affected. Compare the installed client version with 1.12.31 to see whether it falls in the affected range.Source: github.com
What should I do about it?
Upgrade Element Web and Element Desktop to 1.12.32 or later. Until then, avoid clicking links from untrusted sources, especially ones that contain guest_user_id and guest_access_token parameters.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data