element-vector-drive-letter

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · element-vector-drive-letter Write-up: https://abraxaslabs.tech/research/element-vector-drive-letter element-vector-drive-letter Element Desktop v1.12.29 - Element Creations Ltd Class: File read Reach: Local...

CVE-2026-119407

Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with guestuserid and guestaccesstoken to...

EUVD-2026-113791

Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with guestuserid and guestaccesstoken to...

CVE-2026-119407

Versions of Element Web and Element Desktop prior to 1.12.32 are vulnerable to a forced logout issue. The root cause is that the loadSession function accepts guest credentials from URL fragment parameters . A remote unauthenticated attacker can lure a logged-in user into clicking a link containin...

CVE-2026-119407 Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters

Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with guestuserid and guestaccesstoken to...

CVE-2026-119407 Element Web and Element Desktop before 1.12.32 Forced Logout via Guest Credential URL Parameters

Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with guestuserid and guestaccesstoken to...

PT-2026-133464

Name of the Vulnerable Software and Affected Versions Element Web versions prior to 1.12.32 Element Desktop versions prior to 1.12.32 Description Remote unauthenticated attackers can force a guest session and clear local stores by luring logged-in users to open links containing specific URL...

CVE-2026-119407: element-hq: Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession,…

Element Web and Element Desktop before 1.12.32 accept guest credentials from URL fragment parameters in loadSession, allowing remote unauthenticated attackers to log out users and clear local stores. Attackers can lure logged-in users into opening links with guestuserid and guestaccesstoken to...

Astra Linux – vulnerability in Thunderbird

The olmsessiondescribe function in Matrix’s libolm prior to version 3.2.7 is vulnerable to a buffer overflow. An Olm session object represents a cryptographic channel between two parties; thus, its state can be partially controlled by the remote party. Attackers can craft a sequence of messages t...

CLEANSTART-2024-NV58280 logic error in the room key sharing functionality of Element Android before 1

Security vulnerability affects the element-web package. A logic error in the room key sharing functionality of Element Android before 1...

CLEANSTART-2024-FT51773 logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12

Security vulnerability affects the element-web package. A logic error in the room key sharing functionality of matrix-js-sdk aka Matrix Javascript SDK before 12...

CLEANSTART-2024-KG85356 matrix-react-sdk is a Matrix chat protocol SDK for React Javascript

Security vulnerability affects the element-web package. matrix-react-sdk is a Matrix chat protocol SDK for React Javascript...

CLEANSTART-2024-IV81629 matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript

Security vulnerability affects the element-web package. matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript...

CLEANSTART-2024-EM09581 Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript

Security vulnerability affects the element-web package. Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript...

CLEANSTART-2024-VR88487 Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript

Security vulnerability affects the element-web package. Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript...

CLEANSTART-2024-YV48715 Matrix JavaScript SDK is the Matrix Client-Server software development kit (SDK) for JavaScript

Security vulnerability affects the element-web package. Matrix JavaScript SDK is the Matrix Client-Server software development kit SDK for JavaScript...

CLEANSTART-2024-QT51844 Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript

Security vulnerability affects the element-web package. Matrix Javascript SDK is the Matrix Client-Server SDK for JavaScript...

CLEANSTART-2024-KH83435 matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript

Security vulnerability affects the element-web package. matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript...

CLEANSTART-2024-LQ80354 matrix-react-sdk is a Matrix chat protocol SDK for React Javascript

Security vulnerability affects the element-web package. matrix-react-sdk is a Matrix chat protocol SDK for React Javascript...

CLEANSTART-2024-ZD82819 matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page

Security vulnerability affects the element-web package. matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page...