Is there a public PoC exploit available for CVE-2026-15472?

Yes, a public proof-of-concept exploit is available for CVE-2026-15472. Prioritise patching immediately. EPSS: 0.2%.

Eleveo Call Recording CVE-2026-15472

Q: What is the CVSS score of CVE-2026-15472?

CVE-2026-15472 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-43194 LOW

Improper Authorization (CWE-285)

2026-07-12 VulDB

GHSA-jvw9-2m88-ppg9

Authentication Bypass Call Recording Software

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-accessible endpoint requires low-privilege authentication; only limited confidentiality impact with no integrity or availability consequence and no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 12, 2026 - 02:22 NVD

MEDIUM LOW

CVSS changed

Jul 12, 2026 - 02:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 12, 2026 - 01:42 vuln.today

DescriptionCVE.org

A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/composeEmailAction.do. Executing a manipulation can lead to improper authorization. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Improper authorization in Eleveo Call Recording Software 9.7.0 allows authenticated remote attackers to bypass access controls on the /callrec/composeEmailAction.do endpoint, exposing limited confidential data. The flaw (CWE-285) means the application fails to enforce authorization decisions for at least one action reachable by low-privileged authenticated users. A publicly available proof-of-concept exploit has been disclosed via VulDB, and no vendor patch exists - the vendor did not respond to the coordinated disclosure. No public exploit identified at time of analysis as actively exploited (not in CISA KEV), though exploit code exists.

Technical ContextAI

The affected component is the /callrec/composeEmailAction.do servlet action within Eleveo's call recording platform, version 9.7.0. The .do URL suffix is characteristic of Java MVC frameworks such as Apache Struts or Spring MVC, where action classes handle HTTP requests. CWE-285 (Improper Authorization) indicates the application authenticates the user but fails to verify whether that user is authorized to invoke the composeEmailAction functionality - a logical access control failure distinct from authentication bypass. The CPE string cpe:2.3:a:eleveo:call_recording_software:*:*:*:*:*:*:*:* uses a wildcard version field, suggesting NVD has not confirmed a precise version boundary, though the disclosure specifically names 9.7.0. Eleveo is a specialized enterprise contact center and compliance recording vendor.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to the coordinated disclosure reported via VulDB. As a compensating control, administrators should restrict access to the /callrec/composeEmailAction.do endpoint at the web application firewall or reverse proxy layer, allowing only explicitly authorized user roles or IP ranges to reach it. Additionally, enforce role-based access control (RBAC) at the network perimeter and review application-level access logs for anomalous invocations of the composeEmailAction endpoint. Consider disabling or blocking the email composition feature entirely if it is not operationally required, as this would eliminate the attack surface without requiring a patch. Monitor VulDB entry https://vuldb.com/vuln/377777 for any future vendor patch or advisory.