Eleveo Quality Management CVE-2026-101146

Requires a valid low-privilege authenticated session (CVSS PR:L) with network access to the Eleveo Quality Management web tier and its GWT RPC endpoint /qm/cz.zoom.scorecard.webui.Scorecard/QMUtilsService. The specific attack targets the createAndSaveAudit function of UtilsService via the GWT RPC Handler; no user interaction is needed (UI:N). Limiting factors: exploitation is not possible without authentication, the impact is confined to limited information disclosure (VC:L, no integrity or availability effect), and it is specific to version 9.7.0 of this niche product. A public exploit exists, reducing the effort required to weaponize it.

This is a moderate, real-but-narrow risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) describes a remotely reachable, low-complexity issue that nonetheless requires existing low-privilege authentication (PR:L) and yields only limited confidentiality impact (VC:L) with no integrity or availability effect - consistent with the CWE-200 information-disclosure classification and the vendor's 5.3 (medium) score. Two signals push toward genuine, if bounded, priority: the E:P (Proof-of-Concept) exploit maturity flag in the vector AND a publicly released exploit (Google Drive link), which are consistent with each other. Countervailing signals keep it low-to-medium: there is NO EPSS score provided to gauge exploitation likelihood, NO CISA KEV listing (so no confirmed active exploitation), and the impact is a single low-severity data leak against an authenticated feature, not unauthenticated compromise. Note the vendor was contacted and did not respond, so there is no patch - an operational risk factor, though the affected product (Eleveo Quality Management, a niche contact-center suite) has a small deployment footprint. Bottom line: a legitimately public-exploit-backed issue, but limited by required authentication and low impact - treat as low-to-medium, not a drop-everything priority.

An attacker who already holds a low-privilege account on an Eleveo Quality Management 9.7.0 instance sends a crafted GWT RPC request to the UtilsService.createAndSaveAudit endpoint at /qm/cz.zoom.scorecard.webui.Scorecard/QMUtilsService and manipulates the call to elicit disclosure of information they should not be able to read. A public exploit has been released (hosted on Google Drive and referenced by VulDB), lowering the skill barrier, though exploitation still requires network reachability to the QM web tier and valid low-privilege credentials.