CVE-2026-48007 Overview
Element Call, a native Matrix video conferencing application, leaks full page URLs including URL fragments to a configured PostHog analytics server. Versions 0.5.17 through 0.19.3 transmit the $initial_person_info, $session_entry_url, and $current_url fields containing the complete visited URL. For standalone Element Call Single Page Application (SPA) deployments such as call.element.io, these URLs encode call encryption passwords in the fragment. Any party with access to both the PostHog analytics data and the encrypted media streams can decrypt the calls. The issue is tracked as [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].
Critical Impact
Attackers with access to PostHog analytics data and encrypted media streams can recover call encryption passwords and decrypt confidential Matrix video conferences.
Affected Products
- Element Call versions 0.5.17 through 0.19.3 (standalone SPA)
- call.element.io hosted deployments configured with PostHog analytics
- Element Call embedded package (issue present but not exploitable in Element Web, Element Desktop, Element X iOS, and Element X Android)
Discovery Timeline
- 2026-08-07 - CVE-2026-48007 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-48007
Vulnerability Analysis
Element Call reports usage analytics to a PostHog server when configured through the posthog key in config.json or via the posthogApiHost and posthogApiKey URL parameters. The PostHog client SDK captures browser navigation context and forwards it to the analytics endpoint. Three fields populated by the SDK carry the full URL of the current page, including everything after the # fragment identifier.
In the standalone Element Call SPA architecture, call join links encode the end-to-end encryption password inside the URL fragment. Fragments normally remain client-side and are not transmitted in HTTP requests. The PostHog telemetry pipeline defeats that boundary by serializing window.location.href into JSON events that ship over the network to the configured analytics host.
Applications embedding the Element Call package such as Element Web, Element Desktop, Element X iOS, and Element X Android are not affected in practice. They distribute encryption keys over Matrix rather than encoding a password in the URL fragment.
Root Cause
The root cause is unsanitized inclusion of sensitive URL fragment data in outbound analytics events. The application did not strip or redact the fragment before invoking PostHog capture calls that read the full location URL.
Attack Vector
An actor who can read the PostHog analytics data stream, either as an operator, a compromised administrator, or through a separate data exposure at the analytics provider, can extract call URLs. Combined with access to the encrypted Matrix media streams, the recovered password decrypts the call contents. Exploitation requires network access and low privileges, but no user interaction beyond a victim joining a call.
Refer to the GitHub Security Advisory GHSA-6vhh-4xw6-h2h2 for the vendor's technical description.
Detection Methods for CVE-2026-48007
Indicators of Compromise
- Outbound HTTPS traffic from Element Call clients to PostHog ingestion endpoints such as app.posthog.com or a custom posthogApiHost value.
- PostHog event payloads containing $initial_person_info, $session_entry_url, or $current_url fields with URL fragments that include call identifiers and password parameters.
- Element Call versions between 0.5.17 and 0.19.3 running in a standalone SPA configuration with a populated posthog key.
Detection Strategies
- Inventory Element Call deployments and identify instances running affected versions with PostHog analytics enabled in config.json.
- Review historical PostHog event exports for URL fields that contain fragment data corresponding to past call sessions.
- Correlate PostHog access logs with Matrix media stream access to identify accounts that could combine both data sources.
Monitoring Recommendations
- Alert on any Element Call client build older than 0.19.4 communicating with PostHog hosts.
- Monitor administrative access to the PostHog project holding Element Call telemetry and require multi-factor authentication.
- Track configuration changes to config.json files in Element Call deployments to detect reintroduction of the posthog key.
How to Mitigate CVE-2026-48007
Immediate Actions Required
- Upgrade all standalone Element Call deployments to version 0.19.4 or later, published in the Element Call v0.19.4 release.
- Treat any call links generated on affected versions as compromised and issue new links for future calls.
- Rotate or purge historical PostHog event data that contains full URL fields captured while running affected versions.
Patch Information
The fix is delivered in Element Call 0.19.4. The release strips URL fragments from analytics events before they are dispatched to PostHog. Release notes and changelog details are available in the Element Call v0.19.4 release.
Workarounds
- Users can opt out of analytics in the Feedback tab of Element Call's settings, then create new call links so that prior URLs are no longer used.
- Administrators hosting standalone Element Call can disable analytics entirely by removing the posthog key from the deployment's config.json file.
- Operators can revoke or rotate the posthogApiKey value to invalidate telemetry collection for affected clients that cannot be updated immediately.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
