CVE-2026-62347

Received Received - Intake

Information Disclosure in Element Call via Rageshake Logs

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description

Element Call is a native Matrix video conferencing application. From 0.16.0 until 0.20.3, the standalone Element Call `SPA` logs the `password` URL query parameter. When a user submits an error report, called a rageshake, these logs are shared with the application operator. Users can therefore unintentionally disclose the shared `password` used to encrypt the call, potentially compromising call confidentiality. Avoiding submission of bug reports or debug logs prevents this disclosure path in affected versions. Upgrading does not remove secrets from previously collected `rageshakes`, which require separate cleanup by the log-server operator. This issue is fixed in version 0.20.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-30

Last Modified

2026-10-30

Generated

2026-10-31

AI Q&A

2026-10-31

EPSS Evaluated

N/A

NVD

CVE-2026-62347

Affected Vendors & Products

Vendor	Product	Version / Range
element-hq	element-call	>= 0.16.0, < 0.20.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-532	The product writes sensitive information to a log file.

Attack-Flow Graph

Executive Summary

Element Call is a Matrix video conferencing app. From versions 0.16.0 to 0.20.3, it logs the password URL query parameter used to encrypt calls. When users submit error reports (rageshakes), these logs may be shared with operators, potentially exposing the password and compromising call confidentiality.

Detection Guidance

Check Element Call logs for the presence of password query parameters in rageshake reports. Review logs for versions 0.16.0 to 0.20.3 where passwords may be logged.

Impact Analysis

If you used an affected version, your call encryption password could be exposed if you submitted an error report. This may allow unauthorized access to call content. Upgrading to version 0.20.3 or later does not remove passwords from previously submitted reports.

Mitigation Strategies

Upgrade to Element Call version 0.20.3 or later. Avoid submitting bug reports or debug logs to prevent password disclosure. Operators should clean previously collected rageshakes containing secrets.

Hi! I’m here to help you understand CVE-2026-62347. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70