Is there a public PoC exploit available for CVE-2026-15375?

Yes, a public proof-of-concept exploit is available for CVE-2026-15375. Prioritise patching immediately. EPSS: 0.2%.

Eleveo Call Recording CVE-2026-15375

Q: What is the CVSS score of CVE-2026-15375?

CVE-2026-15375 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-42925 LOW

Improper Authorization (CWE-285)

2026-07-10 VulDB

GHSA-c5gr-gm67-478c

Authentication Bypass Call Recording Software

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Low-privilege authentication required (PR:L); impact limited to confidentiality disclosure of LDAP data with no integrity, availability, or scope-change effects.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 16:32 vuln.today

Severity Changed

Jul 10, 2026 - 16:22 NVD

MEDIUM LOW

CVSS changed

Jul 10, 2026 - 16:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability has been found in Eleveo Call Recording Software 9.7.0. This impacts an unknown function of the file /callrec/users_ldap.jsp of the component LDAP User Interface. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Improper authorization in Eleveo Call Recording Software 9.7.0 allows low-privileged authenticated remote users to bypass access controls on the LDAP User Interface endpoint /callrec/users_ldap.jsp, exposing restricted LDAP directory user data without appropriate privilege verification. A public proof-of-concept exploit has been disclosed via Google Drive and the vendor has not responded to responsible disclosure, leaving no official patch or advisory available. The CVSS 4.0 base score of 2.1 reflects narrow confidentiality-only impact, but POC availability and vendor silence increase practical urgency for affected deployments.

Technical ContextAI

The vulnerability exists in a JSP-based LDAP User Interface component (/callrec/users_ldap.jsp) within Eleveo Call Recording Software, a compliance-oriented platform used in enterprise contact center environments for recording and managing calls. CWE-285 (Improper Authorization) describes a failure to verify whether an authenticated principal is permitted to access a specific resource or operation - in this case, the application does not enforce adequate role-based access controls before serving or processing LDAP directory data through this endpoint. LDAP integration in call recording platforms is typically used for centralized user provisioning and authentication against enterprise directories such as Microsoft Active Directory. The affected CPE is cpe:2.3:a:eleveo:call_recording_software:*:*:*:*:*:*:*:*, with version 9.7.0 explicitly confirmed by the VulDB disclosure; the wildcard version field indicates NVD has not narrowed the affected range further due to absent vendor guidance.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to responsible disclosure, and no official advisory URL is available. As a compensating control, restrict access to the /callrec/users_ldap.jsp endpoint via a web application firewall or reverse proxy, limiting requests to known administrative IP ranges only; this reduces attack surface but may disrupt legitimate LDAP management workflows for non-admin network segments. Additionally, audit all platform accounts to ensure only necessary users have access to the Eleveo instance, reducing the pool of principals who could exploit the PR:L requirement. Ensure LDAP service accounts used by Eleveo are scoped to read-only bind operations with minimal directory permissions, limiting the data accessible even if the endpoint is abused. Monitor web server access logs for unexpected requests to the LDAP user interface path. Track https://vuldb.com/vuln/377442 and Eleveo's release notes for patch availability.