Eleveo Quality Management CVE-2026-85408

Exploitation requires a valid Eleveo Quality Management account with at minimum low-privilege access - any standard agent, supervisor, or API integration account suffices. The attacker must have network reach to the /enc-fwk-data/api/v3/conversations/<ID>/events REST endpoint, which in typical contact-center deployments is accessible from the internal corporate network or VPN. The attacker must also know or enumerate a valid conversation ID to target. No non-default configuration, elevated administrative privileges, or victim interaction is required. External unauthenticated attackers are blocked by the PR:L requirement; the attack surface is bounded to authenticated internal users or compromised accounts.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) reflects straightforward network-accessible exploitation requiring only low-privilege credentials - no complex conditions or user interaction. Integrity impact is rated low (VI:L), reflecting that attackers can manipulate conversation metadata rather than achieve code execution or broad data exfiltration. The public PoC (E:P) meaningfully elevates practical risk relative to the base score of 5.3, since even a mid-sized contact center operation in gliwice could face insider misuse or account-compromise scenarios where the PoC is immediately leveraged to falsify quality review records. No CISA KEV listing exists, and the narrow integrity-only impact limits urgency for most organizations, but regulated industries - financial services, healthcare contact centers, and any environment where audit trail integrity carries compliance weight - should treat this with elevated priority. The absence of a vendor patch after disclosure represents an ongoing, unmitigated risk for all 9.7.0 deployments.

A low-privilege agent or supervisor with a valid Eleveo session submits a crafted POST request to /enc-fwk-data/api/v3/conversations/<ID>/events with a createdBy parameter set to a colleague's user identifier. The server binds the value without restriction, recording the event as authored by the victim. The publicly available PoC on Google Drive reduces the technical barrier to near-zero for any credentialed insider.