Is there a public PoC exploit available for CVE-2026-15470?

Yes, a public proof-of-concept exploit is available for CVE-2026-15470. Prioritise patching immediately. EPSS: 0.2%.

Eleveo Call Recording CVE-2026-15470

Q: What is the CVSS score of CVE-2026-15470?

CVE-2026-15470 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-43192 LOW

Improper Authorization (CWE-285)

2026-07-11 VulDB

GHSA-qhq9-8cqg-qc8g

Authentication Bypass Call Recording Software Eleveo

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

PR:L confirmed by authenticated access requirement; C:L for bounded group data read; S:U and I:N/A:N because no integrity, availability, or scope-crossing impact is described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 12, 2026 - 00:26 vuln.today

Severity Changed

Jul 12, 2026 - 00:22 NVD

MEDIUM LOW

CVSS changed

Jul 12, 2026 - 00:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability has been found in Eleveo Call Recording Software 9.7.0. Affected by this issue is some unknown functionality of the file /callrec/group.jsp. Such manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Improper authorization in Eleveo Call Recording Software 9.7.0 allows authenticated remote attackers to access the /callrec/group.jsp endpoint without proper permission checks, resulting in unauthorized read access to call recording group data. A publicly available exploit has been disclosed via Google Drive; the vendor was notified but did not respond, meaning no official patch exists at time of analysis. No public exploit identified at time of analysis is superseded here - a public POC exists (E:P in the CVSS 4.0 vector), though this is not confirmed actively exploited (CISA KEV) and the CVSS 4.0 score of 2.1 reflects limited scope impact.

Technical ContextAI

Eleveo Call Recording Software is a Java-based web application for enterprise and contact-center call capture, as evidenced by the JSP (JavaServer Pages) endpoint at /callrec/group.jsp. The root cause is CWE-285 (Improper Authorization), a class of flaw where the application fails to correctly verify whether an authenticated user has the necessary permissions before granting access to a resource - distinct from authentication failures (CWE-287). In this case, the group management endpoint does not enforce authorization checks, allowing any authenticated user to access group-level call recording data outside their permitted scope. The CPE identifier cpe:2.3:a:eleveo:call_recording_software:*:*:*:*:*:*:*:* with wildcard version fields indicates version 9.7.0 is confirmed affected, with broader version scope uncharacterized in available data.

RemediationAI

No vendor-released patch has been identified at time of analysis; the vendor did not respond to responsible disclosure. As a primary compensating control, restrict access to /callrec/group.jsp at the web application firewall or reverse-proxy layer, limiting requests to only the roles and IP ranges that legitimately require group management access - note this may impact administrators using the group configuration UI. Audit current user role assignments within the Eleveo platform to ensure least-privilege principles are enforced, and review access logs for anomalous requests to the affected endpoint. If the application runs behind a perimeter gateway, ensure the call recording management interface is not exposed to untrusted networks. Organizations should monitor VulDB (https://vuldb.com/cve/CVE-2026-15470) and Eleveo vendor channels for any patch release, as the publicly available exploit (https://drive.google.com/file/d/1mzZ3HKLoMpr44cgxK70xiE2weddfvTsE/view?usp=sharing) lowers the exploitation barrier for insiders.