EUVD-2026-88475
GHSA-wwfr-44pg-7wr5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege account access
-
ExploitSend crafted request to /callrec/searchAction.do Query Builder
-
ExecutionBypass improper access-control check
-
ImpactRead or manipulate unauthorized call-recording data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privilege authenticated account on Eleveo Call Recording Software 9.7.0 (PR:L) and network reachability to the web interface hosting /callrec/searchAction.do (the Query Builder component). No user interaction is needed (UI:N) and attack complexity is low (AC:L/AT:N). Limiting factors: exploitation is confined to the specific 9.7.0 version and the searchAction.do endpoint, it is not unauthenticated (a valid account is a prerequisite), and impact is bounded to limited data access/manipulation with no privilege escalation or scope change. No patch is available, but the requirement for prior authentication meaningfully constrains the attacker population. |
| Impact | This is a moderate-severity broken-access-control flaw with a genuine but limited real-world risk profile. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation, but PR:L confirms the attacker must already hold a valid low-privilege account - this is NOT unauthenticated. The E:P (Proof-of-Concept) exploit maturity plus the confirmed public POC on Google Drive raises practical risk above a purely theoretical finding. However, all impact metrics are Low (VC:L/VI:L/VA:L) with no scope change, so consequences are bounded to limited unauthorized data access/manipulation rather than full compromise. No EPSS score and no CISA KEV listing are provided; absent those, there is no evidence of widespread or active exploitation - this reads as a targeted-opportunity issue, not a mass-exploited one. The 'Authentication Bypass' tag conflicts with the CVSS PR:L requirement: a true auth bypass would be PR:N, so this is more accurately post-authentication broken access control (IDOR-style). Overall: a real but low-priority issue, elevated modestly by public POC availability and vendor non-response (no patch). |
| Exploit ScenarioDerived | A low-privileged authenticated user of Eleveo Call Recording Software 9.7.0 sends a crafted request to the /callrec/searchAction.do Query Builder endpoint, whose improper access controls let them reach query functionality or records outside their authorized scope. A public proof-of-concept exists (linked via VulDB and a Google Drive file), lowering the skill barrier. Because the attack is network-reachable and low-complexity, any holder of a valid low-tier account could replay the PoC to view or manipulate call-recording data they should not access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Improper access control in Eleveo Call Recording Software 9.7.0 allows a low-privilege authenticated user to exercise functionality reachable through the Query Builder endpoint /callrec/searchAction.do that should require higher privileges, resulting in limited unauthorized read and manipulation of call-recording data. The flaw is remotely reachable over the web interface with low attack complexity and no user interaction, and the assessed vector (CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, CVSS 4.0 base 5.3) reflects bounded confidentiality and integrity impact with no scope change. Publicly available exploit code exists - including a publicly shared proof-of-concept file - but attackers must first hold a valid account on the affected system, and the vendor was contacted about the disclosure without responding, so no patch is currently available.
RemediationAI
No vendor-released patch was identified at time of analysis: Eleveo was contacted early about the disclosure and did not respond, so there is no fixed version to upgrade to and no advisory from the vendor to cite; the only reference material is the VulDB record at https://vuldb.com/vuln/410996 and its CTI companion at https://vuldb.com/vuln/410996/cti, which should be monitored for a vendor fix. Until a patch exists, the most effective control is to enforce authorization at a layer the application does not control: place the Eleveo web interface behind a reverse proxy or WAF rule that denies or tightly scopes POST/GET requests to /callrec/searchAction.do to trusted administrative roles and known management source IPs, accepting the trade-off that legitimate supervisor or analyst search workflows will break unless their source ranges and accounts are explicitly allow-listed. If Query Builder search is not operationally required, disable or block that action path entirely - the trade-off is loss of search functionality in call-recording review - and in parallel audit the application's own role model to confirm which accounts genuinely need it, tightening or removing any guest, demo, or shared low-privilege accounts, since the flaw's prerequisite is a valid low-privilege session. Network-level segmentation that restricts reachability of the application server to internal management networks raises the bar for remote abuse but does not fix the missing authorization check, and because proof-of-concept code is already public, log and alert on anomalous access patterns and unusual result-set sizes or parameter values against searchAction.do to detect post-exploitation activity, accepting that such monitoring is detective rather than preventive.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-284 improper access control defect rooted in missing or insufficient server-side authorization checks on the Query Builder component of Eleveo Call Recording Software, exposed via the Java-style Struts/servlet action path /callrec/searchAction.do. A search action of this type typically accepts query parameters that drive lookups against call-recording metadata, and because the action does not enforce role- or ownership-based restrictions, a caller holding only a low-privilege session can construct or replay requests that return or modify records outside their intended scope. The CPE entry cpe:2.3:a:eleveo:call_recording_software:* is not version-pinned, but the disclosure and independent assessment both center on version 9.7.0 and the specific searchAction.do endpoint, so other versions should be treated as unconfirmed rather than presumed affected. Notably, the source database tags the issue as an Authentication Bypass, which could imply unauthenticated access; the authoritative assessed vector contains PR:L, so the accurate precondition is a valid low-privilege account, and readers should not treat this as a pre-authentication flaw. There is no scope change (S:U, SC:N/SI:N/SA:N), no user interaction, and the CVSS 4.0 E:P metric indicates proof-of-concept exploit maturity rather than confirmed active exploitation.
Know when Call Recording Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable low-complexity endpoint but requires a valid low-privilege account (PR:L); access-control flaw yields limited data read and manipulation (C:L/I:L), with no credible availability impact (A:N) despite the vendor claiming VA:L.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/searchAction.do of the component Query Builder. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Call Recording Software
View allImproper authorization in Eleveo Call Recording Software 9.7.0 allows remote authenticated users to access the /callrec/
Improper authorization in Eleveo Call Recording Software 9.7.0 allows remote authenticated low-privileged users to manip
Improper authorization in Eleveo Call Recording Software 9.7.0 allows remote low-privileged users to manipulate the 'rol
Improper authorization in Eleveo Call Recording Software 9.7.0 exposes the /callrec/sendlogfile endpoint to low-privileg
LDAP injection in Eleveo Call Recording Software 9.7.0 lets an authenticated, low-privileged user manipulate the Usernam
Improper authorization in Eleveo Call Recording Software 9.7.0 enables remote authenticated attackers to access call rec
Improper authorization in Eleveo Call Recording Software 9.7.0 allows authenticated remote attackers to bypass access co
Improper authorization on the /callrec/pci_dss_status.jsp endpoint in Eleveo Call Recording Software 9.7.0 allows authen
Improper authorization in Eleveo Call Recording Software 9.7.0 allows authenticated remote attackers to access the /call
Improper authorization in Eleveo Call Recording Software 9.7.0 allows low-privileged authenticated remote users to bypas
Improper authorization in Eleveo Call Recording Software 9.7.0 allows authenticated remote attackers to perform unauthor
Stored or reflected cross-site scripting in Eleveo Call Recording Software 9.7.0 allows an authenticated low-privilege u
Exploit-DB