Live › vulnerability › CVE-2026-62347
Element Call versions 0.16.0 through 0.20.3 log the shared call password from the URL query string. When a user submits a rageshake error report, those logs go to the application operator, exposing the password used to encrypt the call.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 22:25 UTC. All times on this page are UTC.
Teams that self-host or run Element Call from versions 0.16.0 through 0.20.3 and receive rageshake bug reports are exposed, since the call password can appear in those logs. Deployments on 0.20.3 or later are not affected by this path, and teams that do not collect rageshakes have less exposure.
No product ranges from the sources yet.
0.20.3.0.20.3.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Element Call is a native Matrix video conferencing application. From 0.16.0 until 0.20.3, the standalone Element Call SPA logs the password URL query parameter. When a user submits an error report, called a rageshake, these logs are shared with the application operator. Users can therefore unintentionally disclose the shared password used to encrypt the call, potentially compromising call confidentiality. Avoiding submission of bug reports or debug logs prevents this disclosure path in affected versions. Upgrading does not remove secrets from previously collected rageshakes, which require separate cleanup by the log-server operator. This issue is fixed in version 0.20.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-62347")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.