Is there a public PoC exploit available for CVE-2026-15474?

Yes, a public proof-of-concept exploit is available for CVE-2026-15474. Prioritise patching immediately. EPSS: 0.2%.

Eleveo Call Recording CVE-2026-15474

Q: What is the CVSS score of CVE-2026-15474?

CVE-2026-15474 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-43196 LOW

Improper Authorization (CWE-285)

2026-07-12 VulDB

GHSA-7vp6-798p-p545

Authentication Bypass Call Recording Software

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-accessible IDOR requiring only authenticated session; impact is read-only access to call recordings with no integrity, availability, or scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 12, 2026 - 03:22 NVD

MEDIUM LOW

CVSS changed

Jul 12, 2026 - 03:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 12, 2026 - 02:43 vuln.today

DescriptionCVE.org

A security flaw has been discovered in Eleveo Call Recording Software 9.7.0. Impacted is an unknown function of the file /callrec/audio.jsp of the component Call Recording Handler. The manipulation of the argument callId results in improper authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Improper authorization in Eleveo Call Recording Software 9.7.0 enables remote authenticated attackers to access call recordings they are not permitted to view by manipulating the callId parameter in the /callrec/audio.jsp endpoint. The flaw follows a classic Insecure Direct Object Reference (IDOR) pattern under CWE-285, where the application fails to enforce per-user ownership checks on recording identifiers. A public exploit has been released and no vendor patch exists - the vendor did not respond to responsible disclosure - making compensating controls the only available mitigation at this time.

Technical ContextAI

The vulnerability exists within the Call Recording Handler component of Eleveo's web application, specifically the audio.jsp JSP endpoint responsible for serving call audio files. CWE-285 (Improper Authorization) identifies the root cause: the application accepts a caller-supplied callId value and retrieves the corresponding recording without verifying that the authenticated session's user is authorized to access that specific recording. This is a textbook IDOR flaw - the object reference (callId) is not tied to an access control check. The affected product is identified by CPE cpe:2.3:a:eleveo:call_recording_software:*:*:*:*:*:*:*:*, with version 9.7.0 explicitly named in the disclosure. Eleveo targets contact center and compliance recording use cases, meaning affected systems may store sensitive regulated conversation data.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to the responsible disclosure, leaving no official fix version to recommend. As a primary compensating control, enforce strict server-side authorization on the /callrec/audio.jsp endpoint so that each callId request is validated against the authenticated user's permitted recording set before content is returned; this requires application-layer code changes if self-managed. At the network layer, restrict access to the call recording web interface to known internal IP ranges or VPN-only subnets, preventing unauthenticated or unauthorized network-level access entirely. Deploy a WAF rule to detect and block rapid sequential enumeration of callId parameter values, which would indicate active exploitation or probing. Enable detailed access logging for /callrec/audio.jsp and alert on users accessing recordings outside their historical or role-based patterns. Monitor VulDB advisory https://vuldb.com/vuln/377779 for vendor patch availability.