Is there a public PoC exploit available for CVE-2026-15376?

Yes, a public proof-of-concept exploit is available for CVE-2026-15376. Prioritise patching immediately. EPSS: 0.3%.

Eleveo Call Recording CVE-2026-15376

Q: What is the CVSS score of CVE-2026-15376?

CVE-2026-15376 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42934 LOW

Improper Authorization (CWE-285)

2026-07-10 VulDB

GHSA-x3wm-r2cm-wm5q

Authentication Bypass Call Recording Software

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable endpoint requiring low-privilege authentication; no scope change; limited CIA impact consistent with statistics-endpoint authorization bypass.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 10, 2026 - 17:22 NVD

MEDIUM LOW

CVSS changed

Jul 10, 2026 - 17:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 10, 2026 - 17:14 vuln.today

DescriptionCVE.org

A vulnerability was found in Eleveo Call Recording Software 9.7.0. Affected is an unknown function of the file /callrec/statisticReportAction.do. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Improper authorization in Eleveo Call Recording Software 9.7.0 allows remote authenticated users to access the /callrec/statisticReportAction.do endpoint beyond their privilege level, enabling unauthorized read, write, and availability impact on sensitive call statistics and reporting data. The vendor was notified but did not respond, leaving version 9.7.0 unpatched. A proof-of-concept exploit is publicly available, raising immediate risk for any organization running this version of the software.

Technical ContextAI

Eleveo Call Recording Software is an enterprise-grade call capture and compliance platform used in contact center and regulated-industry environments. The affected function resides in statisticReportAction.do - a Java-based action class (consistent with a Struts or similar MVC framework convention) that handles statistical reporting operations. The root cause is CWE-285 (Improper Authorization): the application fails to enforce adequate access-control checks on this endpoint, meaning a user with low-level authenticated access can invoke functions or retrieve data restricted to higher-privileged roles. The CPE entry (cpe:2.3:a:eleveo:call_recording_software:*:*:*:*:*:*:*:*) encompasses the 9.7.0 release without specifying a maximum patched version, consistent with the vendor's non-response to the disclosure.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to the coordinated disclosure. Organizations running Eleveo Call Recording Software 9.7.0 should immediately restrict access to the /callrec/statisticReportAction.do endpoint via web application firewall rules or reverse proxy ACLs, limiting it exclusively to known administrative source IPs; note that this blocks legitimate non-admin users from the statistics functionality. As an additional compensating control, enforce the principle of least privilege within the application's own role management to ensure low-privilege accounts are minimized and monitored. Audit access logs to the statisticReportAction.do endpoint for anomalous access patterns from non-administrative users. Contact Eleveo directly to request a patched release or security advisory; monitor https://vuldb.com/vuln/377443 for updates. Do not expose the call recording management interface to untrusted networks.