TI-2026-82990 Aliases CVE-2026-119407 GHSA-fm3q-8qwm-p5xr

Forced logout in Element Web and Desktop via URL guest credentials

LOW 30CWE-352Published 2026-10-30 · Updated 2026-11-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Tampering
Confidentiality · integrity · availability: None · Low · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-352.

Summary

Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, which is a cross-site request forgery weakness (CWE-352). A remote unauthenticated attacker can lure a logged-in user into opening a crafted link, which forces an attacker-controlled guest session, logs the user out, clears local stores and destroys unbacked end-to-end encryption keys.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with guest_user_id and guest_access_token to force an attacker-controlled guest session and destroy unbacked end-to-end encryption keys.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00142 3rd percentileScored 2026-11-07

Fix Fixed element-web (element-hq): 1.12.32element-desktop (element-hq): 1.12.32

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
element-hq	element-web	before 1.12.32	1.12.32	Patch available	CNA
element-hq	element-desktop	before 1.12.32	1.12.32	Patch available	CNA

element-web Vendorelement-hq Affected before 1.12.32 Fixed in 1.12.32 Patch available CNA
element-desktop Vendorelement-hq Affected before 1.12.32 Fixed in 1.12.32 Patch available CNA

Remediation

Upgrade Element Web and Element Desktop to version 1.12.32 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Fix · CNA element-web (element-hq) Fixed in 1.12.32
Fix · CNA element-desktop (element-hq) Fixed in 1.12.32

Timeline

2026-10-30 Threatist record created from CVE-2026-119407
2026-10-30 Alias added: GHSA-fm3q-8qwm-p5xr
2026-11-01 Priority changed: MEDIUM → LOW
2026-11-04 CISA SSVC decision points changed

References

Patch 1

https://github.com/element-hq/element-web/commit/792453c88a399d570599f5d73b08b40157cd80c0

Advisory 2

Other 3

TI-2024-35327 Synapse allows a a malformed invite to break the invitee's `/sync` CVSS 4.0HIGH 8.7
TI-2024-36056 Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders CVSS 4.0HIGH 8.2
TI-2024-35318 Synapse allows unsupported content types to lead to memory exhaustion CVSS 4.0HIGH 8.2
TI-2022-07650 Remote program execution with user interaction CVSS 3.1HIGH 8.8
TI-2026-19372 ESS Community Helm Chart has a weak server key generation method CVSS 4.0CRITICAL 9.2
TI-2024-24814 Synapse denial of service through media disk space consumption CVSS 3.1HIGH 7.5

See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences