SZB-2f8c64d234
EUVD-2026-113791 reports guest-credential flaw in Element Web and Desktop
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Element
- Product
- Element Web, Element Desktop
- First seen
Summary
The EU Vulnerability Database entry EUVD-2026-113791 describes a flaw in Element Web and Element Desktop before 1.12.32 that accepts guest credentials from URL fragments. It is scored 7.1/10 (CVSS v3.1) and reportedly lets remote unauthenticated attackers log out users and clear local stores.
If you use Element
Update Element Web and Element Desktop to 1.12.32 or later
Avoid opening untrusted links while logged in to Element
Clear local stores after updating if sessions look unexpectedly reset
What the sources say 1
· Mastodon: “Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores.” Source