Is CVE-2026-48007 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48007 being exploited in the wild.

How severe is CVE-2026-48007?

High severity, with a CVSS score of 4, published 7 August 2026.

Which products and versions are affected?

Element Call 0.5.17 - 0.19.3; Element-Call-Embedded 0.5.17 - 0.19.3; @element-hq/element-call-embedded (npm) >= 0.5.17, <= 0.19.3, SEMVER:introduced=0.5.17,fixed=0.19.4.

Is there a fix for CVE-2026-48007?

Yes. @element-hq/element-call-embedded (npm): upgrade to 0.19.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48007 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-48007?

Check whether you run Element Call, Element-Call-Embedded or @element-hq/element-call-embedded (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48007: Element Element Call sensitive information disclosure in analytics reporting

Q: Is there a fix for CVE-2026-48007?

Yes. @element-hq/element-call-embedded (npm): upgrade to 0.19.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-48007 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-48007?

Check whether you run Element Call, Element-Call-Embedded or @element-hq/element-call-embedded (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48007 · Severity: high · CVSS 4 · Published 2026-08-07

Element Call, a video conferencing application, was found to be sending full page URLs to its analytics provider. In standalone versions of the app, these URLs can contain sensitive call encryption passwords. This could allow anyone with access to the analytics data to potentially eavesdrop on private video calls.

Vendors: Element, npm.

Quick answers

Is CVE-2026-48007 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48007 being exploited in the wild.
How severe is CVE-2026-48007?: High severity, with a CVSS score of 4, published 7 August 2026.
Which products and versions are affected?: Element Call 0.5.17 - 0.19.3; Element-Call-Embedded 0.5.17 - 0.19.3; @element-hq/element-call-embedded (npm) >= 0.5.17, <= 0.19.3, SEMVER:introduced=0.5.17,fixed=0.19.4.
Is there a fix for CVE-2026-48007?: Yes. @element-hq/element-call-embedded (npm): upgrade to 0.19.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48007 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-48007?: Check whether you run Element Call, Element-Call-Embedded or @element-hq/element-call-embedded (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@element-hq/element-call-embedded (npm): upgrade to 0.19.4 or later
```
npm install @element-hq/element-call-embedded@0.19.4
```

Technical details

Element Call (versions 0.5.17 through 0.19.3) incorrectly includes the full URL fragment in analytics data sent to PostHog via fields such as $current_url and $session_entry_url. In standalone 'SPA' deployments, call encryption passwords are often stored in the URL fragment, leading to the exposure of these credentials to the analytics platform. An attacker with access to the PostHog analytics data and the encrypted media stream could use these leaked passwords to decrypt and monitor calls. The issue is mitigated in embedded versions (like those in Element Web/Desktop) because they distribute keys via Matrix rather than the URL. The vulnerability is patched in version 0.19.4.

Affected products

Element Element Call 0.5.17 - 0.19.3
Element @element-hq/element-call-embedded 0.5.17 - 0.19.3

Identifiers

CVE-2026-48007
GHSA-6vhh-4xw6-h2h2

Timeline

2026-05-21: patched: Version 0.19.4 released
2026-06-11: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.