Element Call exposes shared passwords in logs
Only affects Element Call 0.16.0 through 0.20.2 when a shared password is in the URL and logs are submitted via error reports. Fixed in 0.20.3.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 0.20.3
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Element Call, a Matrix video conferencing application, is affected: its standalone web version logs the shared call password from the URL, and those logs can reach the application operator when a user submits an error report. This can expose the password used to encrypt calls, weakening their confidentiality.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Element Call is a native Matrix video conferencing application. From 0.16.0 until 0.20.3, the standalone Element Call `SPA` logs the `password` URL query parameter. When a user submits an error report, called a rageshake, these logs are shared with the application operator. Users can therefore unintentionally disclose the shared `password` used to encrypt the call, potentially compromising call confidentiality. Avoiding submission of bug reports or debug logs prevents this disclosure path in affected versions. Upgrading does not remove secrets from previously collected `rageshakes`, which require separate cleanup by the log-server operator. This issue is fixed in version 0.20.3.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- element-hq element-call
From 0.16.0 · fixed in 0.20.3
References 5
GitHub · element-hq/element-call
Questions about CVE-2026-62347
What does this mean?
Element Call versions 0.16.0 through 0.20.2 wrote the password URL query parameter into logs. When a user submits an error report (rageshake) containing those logs, the shared password used to encrypt the call is disclosed to the application operator or the rageshake log server, which can compromise the call's confidentiality.Source: github.com
Am I affected, and how do I check?
Versions 0.16.0 through 0.20.2 of Element Call are affected, including the standalone Element Call SPA instance such as call.element.io. The exposure happens only when error reports or debug logs are submitted through the application. Check the Element Call version in use to see whether it falls in this range.Source: github.com
What should I do about it?
Upgrade Element Call to version 0.20.3, which contains the patch. Until the upgrade is applied, avoid submitting bug reports or debug logs through the application.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data