Is there a public PoC exploit available for CVE-2026-15374?

Yes, a public proof-of-concept exploit is available for CVE-2026-15374. Prioritise patching immediately. EPSS: 0.3%.

Eleveo Call Recording CVE-2026-15374

Q: What is the CVSS score of CVE-2026-15374?

CVE-2026-15374 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42923 LOW

Improper Authorization (CWE-285)

2026-07-10 VulDB

GHSA-7c75-35mf-f3w9

Authentication Bypass Call Recording Software Eleveo

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-accessible endpoint requires low-privileged auth (PR:L); no scope change; limited C/I/A impact consistent with partial role data exposure and unauthorized group modification.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 16:31 vuln.today

Severity Changed

Jul 10, 2026 - 16:22 NVD

MEDIUM LOW

CVSS changed

Jul 10, 2026 - 16:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A flaw has been found in Eleveo Call Recording Software 9.7.0. This affects an unknown function of the file /callrec/roleAddAction.do of the component Group Interface. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Improper authorization in Eleveo Call Recording Software 9.7.0 allows remote authenticated low-privileged users to manipulate the role and group management endpoint (/callrec/roleAddAction.do), bypassing access controls without proper privilege checks. A publicly available exploit exists for this flaw, raising practical risk despite the relatively low CVSS 4.0 score of 2.1 (inflated downward by the E:P threat metric). The vendor was unresponsive to coordinated disclosure, meaning no official patch or acknowledgment exists at time of analysis.

Technical ContextAI

The vulnerability resides in the Group Interface component of Eleveo Call Recording Software 9.7.0, specifically the /callrec/roleAddAction.do endpoint, which handles role assignment and group membership operations. CWE-285 (Improper Authorization) indicates the application fails to enforce sufficient privilege checks before executing role modification actions - a server-side enforcement failure distinct from authentication bypass. The affected CPE is cpe:2.3:a:eleveo:call_recording_software:*:*:*:*:*:*:*:*, suggesting the version wildcard may encompass a broader range than just 9.7.0, though the disclosure explicitly names that version. Eleveo operates in the contact center and compliance recording space, where role-based access control governs access to sensitive recorded audio and metadata.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to coordinated disclosure. As an immediate compensating control, restrict network access to the /callrec/roleAddAction.do endpoint via WAF rules or reverse proxy ACLs, limiting access exclusively to authenticated administrators by source IP or role-based firewall policy. This trade-off is that it may disrupt legitimate admin workflows if conducted remotely. Additionally, audit all existing role assignments for unauthorized changes and enable logging on the Group Interface component to detect exploitation attempts. Review and harden role-based access controls within the application configuration to enforce least-privilege. Monitor VulDB entry https://vuldb.com/vuln/377441 for any patch releases. If the software cannot be adequately protected, consider temporarily isolating the call recording management interface from general network access until a vendor response or patch is available.