Is there a public PoC exploit available for CVE-2026-15471?

Yes, a public proof-of-concept exploit is available for CVE-2026-15471. Prioritise patching immediately. EPSS: 0.2%.

Eleveo Call Recording CVE-2026-15471

Q: What is the CVSS score of CVE-2026-15471?

CVE-2026-15471 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-43193 LOW

Improper Authorization (CWE-285)

2026-07-12 VulDB

GHSA-q5mf-944j-vgq2

Authentication Bypass Call Recording Software Eleveo

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-reachable endpoint requires low-privilege authentication; disclosure is read-only PCI status with no integrity or availability impact and no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 12, 2026 - 02:22 NVD

MEDIUM LOW

CVSS changed

Jul 12, 2026 - 02:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 12, 2026 - 01:41 vuln.today

DescriptionCVE.org

A vulnerability was found in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/pci_dss_status.jsp. Performing a manipulation results in improper authorization. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Improper authorization on the /callrec/pci_dss_status.jsp endpoint in Eleveo Call Recording Software 9.7.0 allows authenticated low-privilege users to access PCI DSS compliance status data they are not authorized to view. The exposed information reveals the payment card compliance posture of the organization, which could be leveraged to identify exploitable compliance gaps and inform targeted attacks against payment infrastructure. A public proof-of-concept exploit exists; the vendor did not respond to responsible disclosure, leaving no official patch or advisory available.

Technical ContextAI

Eleveo Call Recording Software is a contact-center compliance platform used to record, store, and audit calls in environments subject to PCI DSS requirements. The vulnerable component is pci_dss_status.jsp, a JavaServer Pages endpoint that surfaces PCI DSS compliance state. CWE-285 (Improper Authorization) indicates the application either omits or inadequately enforces an authorization check on this endpoint - authenticated users whose role should not permit access to compliance dashboards can retrieve the data anyway. The CPE string cpe:2.3:a:eleveo:call_recording_software:*:*:*:*:*:*:*:* uses a wildcard version field, implying NVD has not bounded the affected range to 9.7.0 alone, though only that version is explicitly confirmed in the CVE description. The CVSS 4.0 vector AV:N/PR:L confirms network-accessible exploitation by authenticated users, consistent with a web application authorization bypass rather than a session or transport-layer flaw.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to disclosure outreach and no official fix or advisory is available. As a compensating control, restrict access to /callrec/pci_dss_status.jsp at the reverse proxy or WAF layer, permitting requests only from administrator IP ranges and blocking all other authenticated users; this directly neutralizes the authorization bypass without requiring application changes. Network segmentation isolating the Eleveo platform from general agent workstation subnets reduces the population of users who can reach the endpoint at all. Enable and monitor access logs for requests to pci_dss_status.jsp as a detection measure. Organizations should contact Eleveo support directly to demand a remediation timeline and reference CVE-2026-15471 and VulDB entry https://vuldb.com/vuln/377776 when doing so.