Eleveo Call Recording CVE-2026-101141

Exploitation targets the Play Audio Page endpoint /callrec/audio.jsp of Eleveo Call Recording Software 9.7.0, using the viewRoleId or cfType request parameter as the reflected XSS vector. Per the CVSS 4.0 vector, the attacker or a victim needs a low-privilege authenticated account (PR:L) and an authenticated user must interact by opening the crafted link (UI:P), so this is not a zero-click or fully unauthenticated attack. No patched version is available since the vendor did not respond to disclosure, extending exposure for deployed 9.7.0 instances.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N, base 5.1) describes a reflected cross-site scripting flaw that is network-reachable but constrained by two real limiters: PR:L means the attacker (or victim) must hold at least a low-privilege authenticated account on the recording platform, and UI:P means a legitimate user must interact with the crafted /callrec/audio.jsp link for the payload to fire. Impact is bounded to low integrity (VI:L) with no confidentiality or availability effect in the vendor scoring, consistent with a single reflected sink rather than a persistent or privilege-escalating flaw. Exploitation signals are mixed: a POC is publicly available (VulDB-hosted Google Drive link) and E:P is set, but there is no EPSS score, no CISA KEV listing, and no evidence of active exploitation - publicly available exploit code exists but that is distinct from in-the-wild use. The vendor did not respond to disclosure, so no patch is confirmed, which raises exposure duration but does not by itself indicate widespread targeting. Net: a genuine but modest-severity issue whose real-world priority is held down by the authentication requirement, required user interaction, and the niche footprint of the affected product.

An attacker with a low-privilege account on the Eleveo platform (or who can lure an authenticated user) crafts a malicious /callrec/audio.jsp URL that injects script via the viewRoleId or cfType parameter. When an authenticated user opens the link, the reflected payload executes in their browser session, letting the attacker run script in the application context to hijack the session or perform actions as that user. A public POC is available, lowering the bar to reproduce the attack.