Element HQ Element Call up to 0.5.17/0.19.3 Analytics Reporting config.json information disclosure

Summaryinfo

A vulnerability identified as problematic has been detected in Element HQ Element Call up to 0.5.17/0.19.3. Impacted is an unknown function of the file config.json of the component Analytics Reporting. The manipulation of the argument initial_person_info/session_entry_url/current_url/posthogApiHost/posthogApiKey leads to information disclosure. This vulnerability is referenced as CVE-2026-48007. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in Element HQ Element Call up to 0.5.17/0.19.3 and classified as problematic. This issue affects some unknown functionality of the file config.json of the component Analytics Reporting. The manipulation of the argument initial_person_info/session_entry_url/current_url/posthogApiHost/posthogApiKey with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. The summary by CVE is:

Element Call is a native Matrix video conferencing application. Versions 0.5.17 through 0.19.3 report analytics data to a PostHog server, when configured to by a `posthog` key in config.json or by the `posthogApiHost` and `posthogApiKey` URL parameters. Several fields of this data (`$initial_person_info`, `$session_entry_url`, and `$current_url`) were found to contain the full URL of the user's visited page, including the fragment. Users of a standalone Element Call ‘SPA’ instance such as https://call.element.io may therefore have reported the full URLs of certain calls, including encryption passwords, to the configured PostHog server, potentially compromising the confidentiality of the calls to actors who could access both the PostHog analytics data and the encrypted media streams. The same issue is present in Element Call's embedded package, but in practice it does not impact applications using this package (including Element Web, Element Desktop, Element X iOS, and Element X Android) because they distribute encryption keys over Matrix rather than encoding a password in the URL. The issue is patched in Element Call 0.19.4. Some workarounds are available. Users may opt out of analytics in the 'Feedback' tab of Element Call's settings and create new links for future calls. Admins who host Element Call as a standalone application may disable PostHog analytics entirely by removing the `posthog` key from their deployment's config.json file.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-48007 since 05/20/2026. The exploitation is known to be easy. The attack may be initiated remotely. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

By approaching the search of inurl:config.json it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 0.19.4 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Element HQ

Name

• Element Call

Version

• 0.5.0
• 0.5.1
• 0.5.2
• 0.5.3
• 0.5.4
• 0.5.5
• 0.5.6
• 0.5.7
• 0.5.8
• 0.5.9
• 0.5.10
• 0.5.11
• 0.5.12
• 0.5.13
• 0.5.14
• 0.5.15
• 0.5.16
• 0.5.17
• 0.19.0
• 0.19.1
• 0.19.2
• 0.19.3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion