Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-62347— Element Call exposes shared passwords in logs

Quick assessment

Affected
element-hq element-call
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Element Call 是一款原生的 Matrix 视频会议应用。在 0.16.0 至 0.20.3 版本中，独立的 Element Call 单页应用（SPA）会将 URL 查询参数中的 记录到日志中。当用户提交错误报告（称为 rageshake）时，这些日志会被分享给应用运营方。因此，用户可能无意中泄露用于加密通话的共享 ，从而危及通话的保密性。在受影响版本中，避免提交错误报告或调试日志可防止此类泄露。需要注意的是，升级版本并不会从先前已收集的 rageshake 中移除敏感信息，这些内容需要由日志服务器运营

CVSS 5.9 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-62347

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Element Call exposes shared passwords in logs
Source: CVE Program / CVE List V5
Vulnerability Description
Element Call is a native Matrix video conferencing application. From 0.16.0 until 0.20.3, the standalone Element Call `SPA` logs the `password` URL query parameter. When a user submits an error report, called a rageshake, these logs are shared with the application operator. Users can therefore unintentionally disclose the shared `password` used to encrypt the call, potentially compromising call confidentiality. Avoiding submission of bug reports or debug logs prevents this disclosure path in affected versions. Upgrading does not remove secrets from previously collected `rageshakes`, which require separate cleanup by the log-server operator. This issue is fixed in version 0.20.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过日志文件的信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
element-hq element-call >= 0.16.0, < 0.20.3 -

II. Public POCs for CVE-2026-62347

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-62347

请登录查看更多情报信息。

Other References for CVE-2026-62347 (5)

IV. Related Vulnerabilities

Same product: element-call
Same vendor: element-hq
Same weakness: CWE-532