Eleveo Call Recording CVE-2026-15375

Exploitation requires a valid authenticated session with at least low-privilege credentials on the Eleveo Call Recording Software 9.7.0 instance - the CVSS 4.0 vector PR:L confirms unauthenticated exploitation is not possible. The Eleveo instance must have LDAP integration configured and the /callrec/users_ldap.jsp endpoint must be reachable over the network (AV:N). No additional attack requirements or prerequisites (AT:N) are specified. Exploitation is limited by the need for any valid application credential; external unauthenticated attackers cannot directly exploit this without first obtaining platform access. The impact is bounded to low confidentiality disclosure (VC:L) with no integrity or availability effects and no impact on subsequent systems (SC:N/SI:N/SA:N).

The CVSS 4.0 base score of 2.1 and vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N indicate a low-severity, network-accessible flaw with no attack prerequisites beyond a low-privilege account, but with impact confined solely to limited confidentiality disclosure on the vulnerable system and no effect on integrity, availability, or any subsequent system. The supplemental E:P metric confirms a proof-of-concept exploit is publicly available, which meaningfully elevates exploitation likelihood beyond what the base score conveys. This vulnerability is not listed in CISA KEV, so active exploitation in the wild is not confirmed - only POC availability is established. No EPSS data was provided in the input. The primary real-world concern is that in environments where LDAP directory data (user attributes, account names, or LDAP connection configuration) is accessible via this endpoint, a compromised low-privilege call recording account could facilitate reconnaissance for lateral movement or privilege escalation, particularly if LDAP credentials are reused across systems. The vendor's non-response to responsible disclosure is a significant negative signal for timely remediation. Overall, this is a low-base-score issue elevated in practical priority by POC availability and vendor silence rather than inherent exploit sophistication.

An attacker with any valid low-privilege Eleveo account - such as a regular call recording user - sends a crafted HTTP GET or POST request directly to /callrec/users_ldap.jsp from a network-accessible position, bypassing the intended authorization check because the server fails to validate the user's role before processing the request. The attacker retrieves LDAP user directory data (usernames, attributes, or LDAP configuration details) that should be restricted to administrative roles. A public proof-of-concept is available on Google Drive (referenced in disclosure), further lowering the technical barrier for exploitation by any authenticated platform user.