Eleveo Call Recording CVE-2026-15376

Exploitation requires a valid authenticated session with at least low-privilege access to the Eleveo Call Recording Software 9.7.0 web interface - unauthenticated exploitation is not indicated by the CVSS PR:L metric. The vulnerable endpoint is /callrec/statisticReportAction.do, which must be reachable over the network. No special non-default configuration is required; the flaw is in the authorization logic of this specific action handler. Exploitation is limited by the requirement for a valid low-privilege credential: anonymous internet access is insufficient. The attack is further constrained to environments running exactly version 9.7.0, as no broader version range has been confirmed.

The CVSS 4.0 base score of 5.3 (Medium) reflects a network-accessible, low-complexity flaw requiring low-privilege authentication, with limited impact across confidentiality, integrity, and availability. The E:P supplemental metric confirms a proof-of-concept is publicly available, elevating practical risk above the base score alone. KEV status is absent, indicating no confirmed widespread active exploitation at time of analysis - however, the combination of a public PoC and an unresponsive vendor with no patch significantly increases risk for organizations running 9.7.0. EPSS data was not provided; given the niche deployment footprint of Eleveo, mass exploitation is unlikely, but targeted abuse by insiders or authenticated threat actors in call center environments is realistic. The PR:L requirement limits opportunistic internet-wide attacks but does not neutralize risk from malicious insiders or compromised low-privilege accounts.

An authenticated user with a standard low-privilege account - such as a call center agent - sends a crafted HTTP GET or POST request directly to /callrec/statisticReportAction.do with parameters that would normally be restricted to supervisors or administrators. Because the authorization check is improperly enforced, the server processes the request and returns sensitive statistical reports, call metadata, or allows modification of reporting data. The publicly available proof-of-concept (https://drive.google.com/file/d/18l6-Lpvqq1B-ureww1zR5d_nyhZl312q/view) means an attacker does not need to discover the technique independently.