CVE-2026-48007 in Element Call
Summary
by MITRE • 08/07/2026
Element Call is a native Matrix video conferencing application. Versions 0.5.17 through 0.19.3 report analytics data to a PostHog server, when configured to by a `posthog` key in config.json or by the `posthogApiHost` and `posthogApiKey` URL parameters. Several fields of this data (`$initial_person_info`, `$session_entry_url`, and `$current_url`) were found to contain the full URL of the user's visited page, including the fragment. Users of a standalone Element Call ‘SPA’ instance such as https://call.element.io may therefore have reported the full URLs of certain calls, including encryption passwords, to the configured PostHog server, potentially compromising the confidentiality of the calls to actors who could access both the PostHog analytics data and the encrypted media streams. The same issue is present in Element Call's embedded package, but in practice it does not impact applications using this package (including Element Web, Element Desktop, Element X iOS, and Element X Android) because they distribute encryption keys over Matrix rather than encoding a password in the URL. The issue is patched in Element Call 0.19.4. Some workarounds are available. Users may opt out of analytics in the 'Feedback' tab of Element Call's settings and create new links for future calls. Admins who host Element Call as a standalone application may disable PostHog analytics entirely by removing the `posthog` key from their deployment's config.json file.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability described involves a privacy and security flaw in Element Call, a native Matrix video conferencing application that collects analytics data through PostHog server integration. This issue affects versions 0.5.17 through 0.19.3 where the application reports specific user data fields including $initial_person_info, $session_entry_url, and $current_url to configured PostHog servers. The technical flaw stems from the inclusion of complete URLs with fragments in these analytics reports, which creates a significant risk when users access standalone Element Call instances such as https://call.element.io where encryption passwords are encoded within URL fragments.
The operational impact of this vulnerability is particularly concerning for confidentiality of video calls since the full URLs containing encryption passwords could be transmitted to PostHog servers accessible by unauthorized parties. This represents a serious breach of the principle of least privilege and violates security standards related to protecting sensitive information in transit, as outlined in CWE-200 (Information Exposure) and CWE-312 (Sensitive Data Exposure). The vulnerability creates an attack surface where adversaries with access to both the PostHog analytics data and encrypted media streams could potentially compromise call confidentiality.
The flaw manifests differently across deployment scenarios, with embedded packages used by Element Web, Element Desktop, Element X iOS, and Element X Android remaining unaffected due to their different key distribution mechanisms over Matrix rather than URL-based password encoding. This differential impact demonstrates the importance of understanding application architecture and data flow patterns in security analysis, aligning with ATT&CK technique T1566 (Phishing) and T1071.004 (Application Layer Protocol: DNS) when considering how information might be leaked through various communication channels.
The vulnerability is addressed in Element Call version 0.19.4 through proper sanitization of URL fragments in analytics reporting. Administrative mitigations include disabling PostHog analytics entirely by removing the posthog key from config.json files for standalone deployments, while end users can opt out of analytics through the Feedback tab settings and generate new call links for future sessions. These remediations align with security best practices for minimizing data collection and protecting user privacy, consistent with NIST SP 800-53 requirements for information system security planning and implementation. The fix demonstrates proper application of input validation and output encoding principles to prevent unintended information disclosure through analytics reporting mechanisms.
This vulnerability exemplifies how seemingly innocuous analytics features can create significant security risks when not properly implemented with privacy considerations in mind, particularly in applications handling sensitive communication data. The issue highlights the critical importance of reviewing all data flows and information exposure points during security assessments, as outlined in CWE-20 (Improper Input Validation) and ATT&CK technique T1587 (Development Tools and Development Environments). Organizations should implement comprehensive security testing including threat modeling to identify such indirect attack vectors that may not be immediately obvious but could have severe consequences for user privacy and data protection.