# CVE-2026-48007: Element Element Call sensitive information disclosure in analytics reporting

Source: https://junglewise.ai/threats/cve-2026-48007-element-element-call-sensitive-information-disclosure-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-07. Updated: 2026-06-11  
License: CC BY 4.0 with a link back

CVE-2026-48007 · Severity: high · CVSS 4 · Published 2026-08-07

Element Call, a video conferencing application, was found to be sending full page URLs to its analytics provider. In standalone versions of the app, these URLs can contain sensitive call encryption passwords. This could allow anyone with access to the analytics data to potentially eavesdrop on private video calls.

Vendors: [Element](https://junglewise.ai/threats/vendors/element), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-48007 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48007 being exploited in the wild.

**How severe is CVE-2026-48007?** High severity, with a CVSS score of 4, published 7 August 2026.

**Which products and versions are affected?** Element Call 0.5.17 - 0.19.3; Element-Call-Embedded 0.5.17 - 0.19.3; @element-hq/element-call-embedded (npm) >= 0.5.17, <= 0.19.3, SEMVER:introduced=0.5.17,fixed=0.19.4.

**Is there a fix for CVE-2026-48007?** Yes. @element-hq/element-call-embedded (npm): upgrade to 0.19.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48007 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-48007?** Check whether you run Element Call, Element-Call-Embedded or @element-hq/element-call-embedded (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @element-hq/element-call-embedded (npm): upgrade to 0.19.4 or later

  ```sh
  npm install @element-hq/element-call-embedded@0.19.4
  ```


## Technical details

Element Call (versions 0.5.17 through 0.19.3) incorrectly includes the full URL fragment in analytics data sent to PostHog via fields such as $current_url and $session_entry_url. In standalone 'SPA' deployments, call encryption passwords are often stored in the URL fragment, leading to the exposure of these credentials to the analytics platform. An attacker with access to the PostHog analytics data and the encrypted media stream could use these leaked passwords to decrypt and monitor calls. The issue is mitigated in embedded versions (like those in Element Web/Desktop) because they distribute keys via Matrix rather than the URL. The vulnerability is patched in version 0.19.4.

## Affected products

- Element Element Call 0.5.17 - 0.19.3
- Element @element-hq/element-call-embedded 0.5.17 - 0.19.3

## Identifiers

- CVE-2026-48007
- GHSA-6vhh-4xw6-h2h2

## Timeline

- 2026-05-21: patched: Version 0.19.4 released
- 2026-06-11: advisory: GitHub Advisory published

## References

- [https://github.com/element-hq/element-call/security/advisories/GHSA-6vhh-4xw6-h2h2](https://github.com/element-hq/element-call/security/advisories/GHSA-6vhh-4xw6-h2h2)
- [https://github.com/element-hq/element-call/releases/tag/v0.19.4](https://github.com/element-hq/element-call/releases/tag/v0.19.4)
- [https://api.github.com/repos/element-hq/element-call/security-advisories/GHSA-6vhh-4xw6-h2h2](https://api.github.com/repos/element-hq/element-call/security-advisories/GHSA-6vhh-4xw6-h2h2)

## Related threats

- [Element Call password logged in URL query parameters](https://junglewise.ai/threats/cve-2026-62347-element-call-is-a-native-matrix-video-conferencing-application)