Element Desktop
Monthly
Element Web and Element Desktop 1.12.31 and earlier will silently log out a logged-in user who opens a link whose URL fragment carries both guest_user_id and guest_access_token, because loadSession adopted those attacker-supplied guest credentials and cleared local stores. The practical consequence is loss of unbacked end-to-end encryption keys and, where no secure backup exists, of the user's digital identity; users with secure backup enabled can recover keys, reducing the outcome to a forced logout. Exploitation requires the victim to already be signed in and to click a crafted link - there is no zero-click path - and version 1.12.32 fixes it; no public exploit code has been confirmed, though the advisory and a research write-up describe the mechanism.
Element Web and Element Desktop 1.12.31 and earlier will silently log out a logged-in user who opens a link whose URL fragment carries both guest_user_id and guest_access_token, because loadSession adopted those attacker-supplied guest credentials and cleared local stores. The practical consequence is loss of unbacked end-to-end encryption keys and, where no secure backup exists, of the user's digital identity; users with secure backup enabled can recover keys, reducing the outcome to a forced logout. Exploitation requires the victim to already be signed in and to click a crafted link - there is no zero-click path - and version 1.12.32 fixes it; no public exploit code has been confirmed, though the advisory and a research write-up describe the mechanism.