CVE-2026-62347

MediumCVSS 5.9

Published: 30/10/2026(UTC)Updated: 02/11/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

23th percentile - higher than 23% of all known CVEs

Summary

The standalone Element Call SPA (from 0.16.0 until 0.20.3) logs the `password` URL query parameter. When a user submits an error report (rageshake), these logs are shared with the application operator, potentially disclosing the shared password used to encrypt the call.

Risk Assessment

Disclosure of the call encryption password can compromise the confidentiality of conference calls. The risk affects organizations whose users submit bug reports from within the application.

Recommendation

Upgrade Element Call to version 0.20.3 or later and stop submitting bug reports and debug logs from affected versions. The log-server operator should also clean secrets from previously collected rageshakes.

Other vulnerabilities in Element Call

CVE-2026-48007High
Element Call versions 0.5.17 through 0.19.3 report analytics data to a PostHog server when configured by a `posthog` key in config.json or by the `posthogApiHost` and `posthogApiKey` URL parameters. Several fields of this data (`$initial_person_info`, `$session_entry_url`, and `$current_url`) were found to contain the full URL of the user's visited page, including the fragment. Users of a standalone Element Call SPA instance such as https://call.element.io may have reported full URLs of certain calls, including encryption passwords, to the configured PostHog server.

Original NVD description (English source)

Element Call is a native Matrix video conferencing application. From 0.16.0 until 0.20.3, the standalone Element Call `SPA` logs the `password` URL query parameter. When a user submits an error report, called a rageshake, these logs are shared with the application operator. Users can therefore unintentionally disclose the shared `password` used to encrypt the call, potentially compromising call confidentiality. Avoiding submission of bug reports or debug logs prevents this disclosure path in affected versions. Upgrading does not remove secrets from previously collected `rageshakes`, which require separate cleanup by the log-server operator. This issue is fixed in version 0.20.3.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS