Skip to main content

Eleveo Call Recording CVE-2026-15375

| EUVDEUVD-2026-42925 LOW
Improper Authorization (CWE-285)
2026-07-10 VulDB GHSA-c5gr-gm67-478c
Authentication Bypass Call Recording Software
2.1
CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY
2.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.3 MEDIUM

Low-privilege authentication required (PR:L); impact limited to confidentiality disclosure of LDAP data with no integrity, availability, or scope-change effects.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Analysis Generated
Jul 10, 2026 - 16:32 vuln.today
Severity Changed
Jul 10, 2026 - 16:22 NVD
MEDIUM LOW
CVSS changed
Jul 10, 2026 - 16:22 NVD
5.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability has been found in Eleveo Call Recording Software 9.7.0. This impacts an unknown function of the file /callrec/users_ldap.jsp of the component LDAP User Interface. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Improper authorization in Eleveo Call Recording Software 9.7.0 allows low-privileged authenticated remote users to bypass access controls on the LDAP User Interface endpoint /callrec/users_ldap.jsp, exposing restricted LDAP directory user data without appropriate privilege verification. A public proof-of-concept exploit has been disclosed via Google Drive and the vendor has not responded to responsible disclosure, leaving no official patch or advisory available. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain low-privilege Eleveo platform account
Exploit
Access network-reachable /callrec/users_ldap.jsp endpoint
Execution
Send HTTP request bypassing authorization check
Impact
Retrieve restricted LDAP user directory data
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid authenticated session with at least low-privilege credentials on the Eleveo Call Recording Software 9.7.0 instance - the CVSS 4.0 vector PR:L confirms unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 2.1 and vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N indicate a low-severity, network-accessible flaw with no attack prerequisites beyond a low-privilege account, but with impact confined solely to limited confidentiality disclosure on the vulnerable system and no effect on integrity, availability, or any subsequent system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with any valid low-privilege Eleveo account - such as a regular call recording user - sends a crafted HTTP GET or POST request directly to `/callrec/users_ldap.jsp` from a network-accessible position, bypassing the intended authorization check because the server fails to validate the user's role before processing the request. The attacker retrieves LDAP user directory data (usernames, attributes, or LDAP configuration details) that should be restricted to administrative roles. …
Remediation No vendor-released patch has been identified at time of analysis - the vendor did not respond to responsible disclosure, and no official advisory URL is available. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Call Recording Software

View all
CVE-2026-15376 LOW POC
2.1 Jul 10

Improper authorization in Eleveo Call Recording Software 9.7.0 allows remote authenticated users to access the /callrec/
CVE-2026-15374 LOW POC
2.1 Jul 10

Improper authorization in Eleveo Call Recording Software 9.7.0 allows remote authenticated low-privileged users to manip
CVE-2026-15373 LOW POC
2.1 Jul 10

Improper authorization in Eleveo Call Recording Software 9.7.0 allows remote low-privileged users to manipulate the 'rol
CVE-2026-15377 LOW POC
2.1 Jul 10

Improper authorization in Eleveo Call Recording Software 9.7.0 exposes the /callrec/sendlogfile endpoint to low-privileg
CVE-2026-15474 LOW POC
2.1 Jul 12

Improper authorization in Eleveo Call Recording Software 9.7.0 enables remote authenticated attackers to access call rec
CVE-2026-15472 LOW POC
2.1 Jul 12

Improper authorization in Eleveo Call Recording Software 9.7.0 allows authenticated remote attackers to bypass access co
CVE-2026-15471 LOW POC
2.1 Jul 12

Improper authorization on the /callrec/pci_dss_status.jsp endpoint in Eleveo Call Recording Software 9.7.0 allows authen
CVE-2026-15470 LOW POC
2.1 Jul 11

Improper authorization in Eleveo Call Recording Software 9.7.0 allows authenticated remote attackers to access the /call
CVE-2026-15473 LOW POC
2.1 Jul 12

Improper authorization in Eleveo Call Recording Software 9.7.0 allows authenticated remote attackers to perform unauthor

Same weakness CWE-285 – Improper Authorization

View all
CVE-2025-29927 CRITICAL POC
9.1
CVE-2016-5676 HIGH POC
7.5
CVE-2025-66301 CRITICAL POC
9.6
CVE-2023-32707 HIGH POC
8.8
CVE-2016-3352 HIGH
8.8
CVE-2025-29659 CRITICAL POC
9.8
CVE-2022-2595 CRITICAL POC
10.0
CVE-2026-30956 CRITICAL POC
9.9

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2026-15375 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy