Element Web CVE-2026-119407

Requires that the victim is already logged into a vulnerable Element Web or Element Desktop build (<=1.12.31) and then opens an attacker-supplied link whose URL fragment carries both guest_user_id and guest_access_token parameters; the vulnerable loadSession path (getGuestHsUrl in apps/web/src/Lifecycle.ts, with the 'guest' fragment param config in url_utils.ts) then adopts those credentials. Limiting factors: passive user interaction is mandatory (the link must be clicked - no zero-click path), exploitation only affects versions before 1.12.32, and permanent data loss occurs only when the user has NOT enabled secure backup / Key storage (Settings > Encryption) - with backup enabled the keys are recoverable, reducing impact to a forced logout.

This is a genuine but conditional issue rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) shows a network-reachable, low-complexity, unauthenticated flaw, but exploitation requires passive user interaction (UI:P) - the victim must open an attacker-crafted link while already logged in, which is characteristic of its CWE-352 CSRF nature. Impact is skewed toward availability/integrity (VC:N/VI:L/VA:H): no data is read, but a forced logout clears local stores and can destroy browser-held E2EE keys, causing irreversible loss of encrypted history and digital identity when secure backup is disabled. The vuln.today decision label is 'this_week' (not act_now/emergency), and there is no CISA KEV listing and no EPSS score in the input, so there is no signal of active or widespread exploitation. A public research write-up (abraxaslabs) and a VulnCheck advisory exist, indicating the mechanism is publicly documented. Net: a real, patch-worthy priority for Element deployments - especially privacy/high-security users relying on unbacked E2EE keys - but the required user interaction and absence of KEV/EPSS data place it below unauthenticated zero-click flaws. Missing data to note: EPSS and KEV status are absent from the input, so exploitation likelihood is inferred from decision label and reference availability only.

An attacker crafts a URL containing guest_user_id and guest_access_token fragment parameters and lures a logged-in Element Web or Desktop user into clicking it (e.g., via chat, email, or a malicious page). On load, the client silently adopts the attacker-controlled guest session, instantly logging the victim out and clearing local stores; if the victim had not enabled secure key backup, their end-to-end encryption keys and encrypted message history are permanently destroyed. A public research reference and vendor advisory document the mechanism, though the input does not confirm packaged working exploit code.