CVE-2026-48007: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in element-hq element-call
Element Call versions 0.5.17 through 0.19.3 exposed sensitive information by sending full URLs, including encryption passwords, to a PostHog analytics server when analytics were enabled. This could compromise call confidentiality if an attacker accessed both the analytics data and encrypted media streams. The vulnerability does not affect embedded Element Call packages used in other Element applications. The issue is fixed in version 0.19.4. Users can opt out of analytics or admins can disable PostHog analytics as workarounds.
AI Analysis
Technical Summary
Element Call, a native Matrix video conferencing application, versions 0.5.17 through 0.19.3, when configured to report analytics to a PostHog server, sent several fields containing the full URL of the user's visited page, including fragments. This included encryption passwords encoded in the URL, potentially exposing sensitive call information to unauthorized actors with access to the PostHog analytics data and encrypted media streams. Embedded Element Call packages used in other Element applications are not impacted due to different key distribution methods. The vulnerability is addressed in Element Call version 0.19.4. Workarounds include opting out of analytics and disabling PostHog analytics in config.json.
Potential Impact
The vulnerability allows exposure of sensitive information such as encryption passwords in URLs to unauthorized actors who can access the PostHog analytics server data. This compromises the confidentiality of calls made using affected Element Call versions configured to send analytics data. The impact is limited to standalone Element Call SPA instances with analytics enabled and does not affect embedded Element Call packages in other Element applications.
Mitigation Recommendations
A fix is available in Element Call version 0.19.4. Users should upgrade to this version to remediate the vulnerability. Alternatively, users may opt out of analytics in the 'Feedback' tab of Element Call settings. Administrators hosting standalone Element Call instances can disable PostHog analytics entirely by removing the 'posthog' key from the deployment's config.json file.
CVE-2026-48007: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in element-hq element-call
Description
Element Call versions 0.5.17 through 0.19.3 exposed sensitive information by sending full URLs, including encryption passwords, to a PostHog analytics server when analytics were enabled. This could compromise call confidentiality if an attacker accessed both the analytics data and encrypted media streams. The vulnerability does not affect embedded Element Call packages used in other Element applications. The issue is fixed in version 0.19.4. Users can opt out of analytics or admins can disable PostHog analytics as workarounds.
CVSS v4.0
Score 8.6high
Affected software
pkg:github/element-hq/element-callRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Element Call, a native Matrix video conferencing application, versions 0.5.17 through 0.19.3, when configured to report analytics to a PostHog server, sent several fields containing the full URL of the user's visited page, including fragments. This included encryption passwords encoded in the URL, potentially exposing sensitive call information to unauthorized actors with access to the PostHog analytics data and encrypted media streams. Embedded Element Call packages used in other Element applications are not impacted due to different key distribution methods. The vulnerability is addressed in Element Call version 0.19.4. Workarounds include opting out of analytics and disabling PostHog analytics in config.json.
Potential Impact
The vulnerability allows exposure of sensitive information such as encryption passwords in URLs to unauthorized actors who can access the PostHog analytics server data. This compromises the confidentiality of calls made using affected Element Call versions configured to send analytics data. The impact is limited to standalone Element Call SPA instances with analytics enabled and does not affect embedded Element Call packages in other Element applications.
Mitigation Recommendations
A fix is available in Element Call version 0.19.4. Users should upgrade to this version to remediate the vulnerability. Alternatively, users may opt out of analytics in the 'Feedback' tab of Element Call settings. Administrators hosting standalone Element Call instances can disable PostHog analytics entirely by removing the 'posthog' key from the deployment's config.json file.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-20T17:44:09.586Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a763509bf8831d5390b0168
Added to database: 08/07/2026, 19:42:01 UTC
Last enriched: 08/07/2026, 19:56:21 UTC
Last updated: 08/07/2026, 20:19:47 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.