CVE-2026-48007

Element Call versions 0.5.17–0.19.3 report analytics data to a PostHog server, and several fields ($initial_person_info, $session_entry_url, $current_url) include the full visited URL (including fragments), potentially exposing encryption passwords to anyone with analytics access. The issue affec...