Is there a public PoC exploit available for EUVD-2026-42917?

Yes, a public proof-of-concept exploit is available for EUVD-2026-42917. Prioritise patching immediately. EPSS: 0.3%.

Eleveo Call Recording EUVD-2026-42917

Q: What is the CVSS score of EUVD-2026-42917?

EUVD-2026-42917 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-15373 LOW

Improper Authorization (CWE-285)

2026-07-10 VulDB

GHSA-g4hc-6r3w-3xjp

Authentication Bypass Call Recording Software

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-reachable endpoint requires low-privilege authentication; role manipulation impacts integrity and confidentiality but does not directly affect availability.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 16:30 vuln.today

Severity Changed

Jul 10, 2026 - 16:22 NVD

MEDIUM LOW

CVSS changed

Jul 10, 2026 - 16:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was detected in Eleveo Call Recording Software 9.7.0. The impacted element is an unknown function of the file /callrec/userAddAction.do. Performing a manipulation of the argument role results in improper authorization. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Improper authorization in Eleveo Call Recording Software 9.7.0 allows remote low-privileged users to manipulate the 'role' parameter in the /callrec/userAddAction.do endpoint, potentially enabling unauthorized role assignment during user creation. The vulnerability carries a CVSS 4.0 score of 2.1 with low-impact metrics across confidentiality, integrity, and availability, though the real-world risk of privilege escalation through role manipulation may be underrepresented by that score. A proof-of-concept exploit is publicly available; no vendor patch exists as the vendor did not respond to responsible disclosure.

Technical ContextAI

Eleveo Call Recording Software is a contact center and compliance recording platform. The vulnerable endpoint /callrec/userAddAction.do handles user creation actions and accepts a 'role' parameter that is not properly validated or authorized by the server - classified under CWE-285 (Improper Authorization). This means the server-side logic fails to enforce that the authenticated user has sufficient privilege to assign the requested role value, allowing the parameter to be freely manipulated in the HTTP request. The CPE string cpe:2.3:a:eleveo:call_recording_software:*:*:*:*:*:*:*:* with a wildcard version component suggests NVD has not pinpointed the full affected range beyond the 9.7.0 version cited in the disclosure.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to the responsible disclosure. Organizations running Eleveo Call Recording Software 9.7.0 should apply compensating controls immediately. Restrict access to the /callrec/userAddAction.do endpoint via a web application firewall (WAF) rule or reverse proxy, allowing only requests originating from trusted administrator IP ranges; note this may disrupt legitimate administrative workflows that rely on this endpoint. Limit network exposure of the call recording application to internal, segmented networks rather than internet-facing infrastructure. Implement server-side audit logging on user creation events and monitor for unexpected role assignments, which can serve as a detective control while a patch is unavailable. Reference VulDB disclosure at https://vuldb.com/vuln/377440 and the exploit file at https://drive.google.com/file/d/1QqpeH0qWsSnSiMvPeRJvRSylwLGK3hsN/view?usp=sharing for technical details to inform WAF rule crafting.