Eleveo Call Recording CVE-2026-101144

Requires a valid low-privilege authenticated account on Eleveo Call Recording Software 9.7.0 (PR:L) and network reachability to the web interface hosting /callrec/searchAction.do (the Query Builder component). No user interaction is needed (UI:N) and attack complexity is low (AC:L/AT:N). Limiting factors: exploitation is confined to the specific 9.7.0 version and the searchAction.do endpoint, it is not unauthenticated (a valid account is a prerequisite), and impact is bounded to limited data access/manipulation with no privilege escalation or scope change. No patch is available, but the requirement for prior authentication meaningfully constrains the attacker population.

This is a moderate-severity broken-access-control flaw with a genuine but limited real-world risk profile. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation, but PR:L confirms the attacker must already hold a valid low-privilege account - this is NOT unauthenticated. The E:P (Proof-of-Concept) exploit maturity plus the confirmed public POC on Google Drive raises practical risk above a purely theoretical finding. However, all impact metrics are Low (VC:L/VI:L/VA:L) with no scope change, so consequences are bounded to limited unauthorized data access/manipulation rather than full compromise. No EPSS score and no CISA KEV listing are provided; absent those, there is no evidence of widespread or active exploitation - this reads as a targeted-opportunity issue, not a mass-exploited one. The 'Authentication Bypass' tag conflicts with the CVSS PR:L requirement: a true auth bypass would be PR:N, so this is more accurately post-authentication broken access control (IDOR-style). Overall: a real but low-priority issue, elevated modestly by public POC availability and vendor non-response (no patch).

A low-privileged authenticated user of Eleveo Call Recording Software 9.7.0 sends a crafted request to the /callrec/searchAction.do Query Builder endpoint, whose improper access controls let them reach query functionality or records outside their authorized scope. A public proof-of-concept exists (linked via VulDB and a Google Drive file), lowering the skill barrier. Because the attack is network-reachable and low-complexity, any holder of a valid low-tier account could replay the PoC to view or manipulate call-recording data they should not access.