Eleveo Quality Management CVE-2026-101143

Requires a valid low-privileged authenticated account on the Eleveo Quality Management 9.7.0 web application (CVSS PR:L) with network access to the /qm/cz.zoom.scorecard.webui.Scorecard/.../QMBODownload endpoint; no user interaction and no special attack requirements are needed (UI:N, AT:N, AC:L). Exploitation is limited by the need for prior authentication and by the impact being confined to low-severity information disclosure (VC:L only, no integrity/availability effect). No non-default configuration is documented as required; the affected version is specifically 9.7.0.

This is a low-to-medium real-world risk despite the availability of public exploit code. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) describes a remotely reachable but AUTHENTICATED (PR:L) issue whose only impact is low-confidentiality information disclosure - no integrity or availability impact, and no scope change. The vendor-assigned 5.3 (Medium) is consistent with that vector. Exploitation status: publicly available exploit code exists (VulDB-hosted Google Drive PoC and the E:P 'Proof-of-Concept' exploit-maturity in the vector), but there is NO CISA KEV listing and NO EPSS score provided, so there is no evidence of active exploitation - PoC availability and active exploitation are distinct signals and only the former is present. The signals are internally consistent (network vector, low complexity, requires an existing low-privileged account, limited data leak), so no metric conflicts need vendor verification. Net: a genuine but contained flaw in a niche enterprise product; prioritize patching where the product is deployed, but it is not an emergency and the low prevalence plus authentication requirement bound the blast radius. Notably, the vendor did not respond to disclosure, so no official patch is confirmed.

An attacker who already holds a low-privileged authenticated account on an Eleveo Quality Management 9.7.0 instance sends a crafted request to the /qm/.../QMBODownload endpoint to retrieve information they should not be able to access, resulting in disclosure of sensitive data (e.g., scorecard/quality-management records). A public proof-of-concept exploit exists (hosted via VulDB), lowering the skill needed, and the low attack complexity (AC:L) means no special timing or race conditions are required.