# CVE-2026-119407: Element Web and Element Desktop URL fragment credential injection

Source: https://junglewise.ai/threats/cve-2026-119407-element-web-and-element-desktop-before-1-12-32-accept-guest  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-119407 · Severity: high · CVSS 7.1 · Published 2026-10-30

Element Web and Element Desktop are collaboration clients for the Matrix communication protocol. Versions before 1.12.32 accept guest credentials passed in URL fragments, allowing attackers to trick logged-in users into opening malicious links that force a guest session, destroy encrypted message keys, and log users out. This can result in permanent loss of encrypted conversations and unauthorized access to user accounts.

Technologies: [Element Web](https://junglewise.ai/threats/technologies/element-web). Vendors: [Element](https://junglewise.ai/threats/vendors/element).

## Quick answers

**Is CVE-2026-119407 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119407 being exploited in the wild.

**How severe is CVE-2026-119407?** High severity, with a CVSS score of 7.1, published 30 October 2026.

**Which products and versions are affected?** Element Desktop before 1.12.32; Element Web before 1.12.32.

**Is there a fix for CVE-2026-119407?** Yes: fixed in Element Web 1.12.32, Element Desktop 1.12.32. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119407 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-119407?** Check whether you run Element Desktop or Element Web at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Element Web 1.12.32, Element Desktop 1.12.32

## Technical details

The loadSession function improperly accepts guest_user_id and guest_access_token parameters from URL fragment identifiers, allowing unauthenticated remote attackers to inject credentials without proper validation. An attacker can craft a malicious URL and social engineer a logged-in user to click it, triggering a forced guest session that overwrites the current session and irreversibly destroys end-to-end encryption keys stored locally. No user interaction beyond clicking a link is required beyond the initial social engineering.

## Affected products

- Element Element Web before 1.12.32
- Element Element Desktop before 1.12.32

## Timeline

- 2026-10-30: disclosed

## References

- [https://abraxaslabs.tech/research/element-fragment-guest](https://abraxaslabs.tech/research/element-fragment-guest)
- [https://github.com/element-hq/element-web](https://github.com/element-hq/element-web)

## Related threats

- [Element Web cross-site scripting in embedded page](https://junglewise.ai/threats/cve-2026-55850-element-web-cross-site-scripting-in-embedded-page)
- [Matrix matrix-js-sdk E2EE room key disclosure to homeservers](https://junglewise.ai/threats/cve-2021-40823-matrix-matrix-js-sdk-e2ee-room-key-disclosure-to-homeservers)