Eleveo Call Recording CVE-2026-15474

Exploitation requires a valid authenticated session to the Eleveo Call Recording Software web interface (PR:L per CVSS 4.0 vector) - unauthenticated exploitation is not possible. The attacker must have network access to the /callrec/audio.jsp endpoint, which is part of the standard call recording web UI and thus expected to be reachable by any user of the system. No special non-default configuration is required; the vulnerable authorization check (or lack thereof) is present in the standard endpoint. Exploitation is bounded by: (1) the requirement for a legitimately provisioned user account on the target system, and (2) the need to know or enumerate valid callId values - however, sequential integer or predictable identifiers are commonly used in such systems, reducing this barrier. Impact is limited to reading call recordings (VC:L); no write, delete, or system-level impact has been identified from available data.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P) reflects a medium-severity, low-complexity network-exploitable flaw requiring only a low-privilege authenticated session. The overall base score of 5.3 is modest, constrained by limited confidentiality impact (VC:L) and zero integrity or availability impact. However, three compounding factors elevate practical priority: (1) a public exploit is confirmed released (E:P modifier applied), substantially lowering attacker barrier; (2) the vendor has not responded to disclosure, leaving no official patch path; (3) call recording platforms in regulated industries store legally protected or sensitive conversation data, meaning even 'low' confidentiality impact may have disproportionate compliance and legal consequences for affected organizations. This is not a high-CVSS-but-low-real-risk case - it is a moderate-CVSS-but-contextually-elevated-risk case for organizations in financial services, healthcare, or legal sectors. No EPSS score was provided; exploitation probability cannot be quantitatively assessed from available data.

An attacker with a valid low-privilege account on an Eleveo 9.7.0 deployment sends crafted HTTP GET requests to /callrec/audio.jsp?callId=<enumerated_value>, iterating through sequential or predictable call identifiers. Because no server-side ownership check is enforced, the server returns audio recordings belonging to other users or restricted lines. A public exploit demonstrating this technique is available at the referenced Google Drive link, meaning even low-skill attackers can reproduce the attack without custom tooling.