CVE-2026-48007
Received Received - Intake

Information Disclosure in Element Call

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description
Element Call is a native Matrix video conferencing application. Versions 0.5.17 through 0.19.3 report analytics data to a PostHog server, when configured to by a `posthog` key in config.json or by the `posthogApiHost` and `posthogApiKey` URL parameters. Several fields of this data (`$initial_person_info`, `$session_entry_url`, and `$current_url`) were found to contain the full URL of the user's visited page, including the fragment. Users of a standalone Element Call ‘SPA’ instance such as https://call.element.io may therefore have reported the full URLs of certain calls, including encryption passwords, to the configured PostHog server, potentially compromising the confidentiality of the calls to actors who could access both the PostHog analytics data and the encrypted media streams. The same issue is present in Element Call's embedded package, but in practice it does not impact applications using this package (including Element Web, Element Desktop, Element X iOS, and Element X Android) because they distribute encryption keys over Matrix rather than encoding a password in the URL. The issue is patched in Element Call 0.19.4. Some workarounds are available. Users may opt out of analytics in the 'Feedback' tab of Element Call's settings and create new links for future calls. Admins who host Element Call as a standalone application may disable PostHog analytics entirely by removing the `posthog` key from their deployment's config.json file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-08
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-48007
EUVD
EUVD-2026-54618

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
element call From 0.5.17 (inc) to 0.19.3 (inc)
element call 0.19.4
element call 0.5.17
element call 0.19.3
element call From 0.19.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Element Call versions 0.5.17 through 0.19.3 send full URLs of visited pages, including fragments with sensitive data like encryption passwords, to a PostHog analytics server when configured. This exposes call details to unauthorized actors who could access both analytics data and encrypted media streams.

Detection Guidance

To detect if your Element Call instance is sending full URLs to PostHog, inspect network traffic for POST requests to PostHog endpoints. Check config.json for a 'posthog' key or verify if 'posthogApiHost' and 'posthogApiKey' parameters are set in URLs. Use browser developer tools to monitor outgoing requests from Element Call.

Impact Analysis
  • Users of standalone Element Call instances may have their call URLs, including encryption passwords, exposed to analytics servers.
  • Standalone instances like https://call.element.io are affected, but embedded packages (Element Web, Desktop, mobile apps) are not due to different key distribution methods.
  • Impact includes potential confidentiality breaches of call content if attackers access both analytics data and encrypted streams.
Compliance Impact

This vulnerability may violate data protection regulations like GDPR or HIPAA by exposing personally identifiable information or sensitive call data through analytics tracking. Organizations must ensure compliance by disabling analytics or opting out of data collection to prevent unauthorized exposure of user data.

Mitigation Strategies

Upgrade to Element Call 0.19.4 or later. Disable PostHog analytics by removing the 'posthog' key from config.json or opt out of analytics in Element Call settings. For standalone instances, ensure no sensitive data like encryption passwords is included in URLs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48007. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart