HIGHCVSS v3.1 7.1Vulnerability
CVE-2026-119407
Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with guest_user_id and guest_access_token to force an attacker-controlled guest session and destroy unbacked end-to-end encryption keys.
Properties
- Severity
- HIGH
- Nvd fetched at
- 2026-10-30T16:01:42.334480+00:00
- Cvss severity
- HIGH
- Cvss score
- 7.1
- Retrieved at
- 2026-10-30T16:05:55+00:00
- Score
- 7.1
- Cvss version
- 3.1
- Last source
- NVD
- Cve id
- CVE-2026-119407
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
- First seen by Signal
- 2026-10-30T16:05:55+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
- Published at
- 2026-10-30T12:16:37.120
- Last modified
- 2026-10-30T12:16:37.120
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph