Eleveo Call Recording CVE-2026-15472

Exploitation requires a valid authenticated session with at least low-privilege credentials on the Eleveo Call Recording Software 9.7.0 instance (PR:L per CVSS 4.0 vector). The attacker must have network access to the application's HTTP interface (AV:N). The specific vulnerable endpoint /callrec/composeEmailAction.do must be reachable and the email composition feature must be present in the deployment. No special non-default configuration is required beyond having a user account. Exploitation is limited by the authentication prerequisite - unauthenticated external attackers cannot trigger this flaw without first obtaining credentials. The impact is read-only access to limited confidential data (VC:L); no integrity or availability impact is indicated.

The CVSS 4.0 score of 5.3 (Medium) reflects the constrained impact profile: VC:L with no integrity or availability impact, and a requirement for low-privilege authentication (PR:L). The E:P supplemental metric confirms a publicly available proof-of-concept, which elevates practical risk above what the base score alone suggests. There is no CISA KEV listing, indicating no confirmed widespread active exploitation at time of analysis. EPSS data is not provided; given the niche product footprint and authentication requirement, opportunistic mass exploitation is unlikely - targeted insider or post-authentication abuse is the more realistic threat model. The absence of any vendor response to disclosure is a notable risk amplifier: there is no patch, no advisory, and no confirmed fix timeline. The CVSS vector is consistent with the description - network-accessible, low-privilege-authenticated exploitation with limited read-only data exposure.

An attacker with a valid low-privilege account - such as a call center agent or auditor user - sends a crafted HTTP request directly to /callrec/composeEmailAction.do without holding the administrative or manager role that should be required. The application fails to enforce the authorization check, granting the attacker access to email composition functionality or associated call record data they are not permitted to view. A public proof-of-concept demonstrating this flow exists and has been shared via Google Drive as part of the VulDB disclosure.