CVE-2026-62347 Details
Description
Element Call is a native Matrix video conferencing application. From 0.16.0 until 0.20.3, the standalone Element Call `SPA` logs the `password` URL query parameter. When a user submits an error report, called a rageshake, these logs are shared with the application operator. Users can therefore unintentionally disclose the shared `password` used to encrypt the call, potentially compromising call confidentiality. Avoiding submission of bug reports or debug logs prevents this disclosure path in affected versions. Upgrading does not remove secrets from previously collected `rageshakes`, which require separate cleanup by the log-server operator. This issue is fixed in version 0.20.3.
A vulnerability in Element Call, a Matrix video conferencing application, allows for the unintentional disclosure of passwords used to encrypt calls. This issue affects versions 0.16.0 through 0.20.2 of the standalone Element Call SPA. The vulnerability arises because the application logs the password URL query parameter, which is then shared with the application operator when a user submits an error report, known as a rageshake. As a result, call confidentiality could be compromised.
Users can upgrade to Element Call version 0.20.3, which addresses this vulnerability. However, it's important to note that upgrading does not remove passwords from previously collected rageshake reports. If running a self-hosted rageshake server, additional steps may be needed to ensure call confidentiality for users.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 30, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-532 | Insertion of Sensitive Information into Log File | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Element Call | >= 0.16.0, <= 0.20.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Oct 30, 2026 | New CVE Received | [email protected] |