Element Call, a native Matrix video conferencing application, recorded the password query parameter in its SPA logs from version 0.16.0 through 0.20.3. When users submitted a rageshake error report, those logs were sent to the application operator, potentially exposing the shared password that encrypts the call. The exposure directly threatens call confidentiality and could allow an attacker who gains access to the logs to decrypt or join the call.

The vulnerability affects Element Call version 0.16.0 to 0.20.3, released by element-hq. No other vendors or product lines are mentioned as impacted.

The CVSS score of 5.9 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires access to the logs, typically provided to the application operator. The likely attack vector is an attacker or compromised operator who can read the logs containing the password. Upgrading does not retroactively remove secrets from previously collected logs, so post‑upgrade cleanup remains essential.