The vulnerability in Element Web and Element Desktop versions prior to 1.12.32 allows attackers to craft a URL containing guest_user_id and guest_access_token fragment parameters. When a logged‑in user opens such a link, the application loads the guest session, forcibly logs the user out, and clears local storage, which includes unbacked end‑to‑end encryption keys. Thus a remote unauthenticated attacker can disrupt the user’s session and cause loss of data. This flaw corresponds to a Cross‑Site Request Forgery (CWE‑352) weakness.

Element Web and Element Desktop, supplied by Element HQ, are affected in all releases before 1.12.32. The CVE data does not specify an edition; therefore it is not known if the flaw only applies to community or enterprise editions. Users running any version older than 1.12.32 on either desktop or web client are vulnerable.

The CVSS base score is 7.1, indicating a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attacker must send a crafted link containing guest credentials, which a logged‑in user might click; this is a typical remote unauthenticated CSRF scenario. The lack of a current EPSS score does not preclude exploitation, especially since the flaw is simple to trigger. Organizations running unpatched versions are thus at risk of session termination and loss of locally stored encryption keys.