CVE-2026-15373: Eleveo Call Recording Software Privilege Escalation Vulnerability

Technical summary

CVE-2026-15373 is an improper authorization vulnerability in Eleveo Call Recording Software 9.7.0 affecting the /callrec/userAddAction.do handler. The flaw stems from insufficient validation of the 'role' parameter during user account operations, allowing authenticated attackers to bypass authorization controls (CWE-266, CWE-285). The application fails to properly verify that the requesting user has authority to assign or modify roles, enabling privilege escalation. With a CVSS v3.1 score of 6.3 (MEDIUM), the attack vector is network-based, requires low complexity, and demands only low privileges (pre-authentication to the system).

Business impact

Organizations deploying Eleveo Call Recording Software 9.7.0 face internal threat scenarios where disgruntled or compromised user accounts can elevate their own permissions or create administrative backdoors without detection. This enables unauthorized access to call recordings, customer data, compliance logs, and system configuration. For industries under regulatory scrutiny (finance, healthcare, contact centers), unauthorized privilege escalation creates audit trail corruption and potential compliance violations. The availability of public exploits shortens the window before opportunistic attacks occur.

Affected systems

Eleveo Call Recording Software version 9.7.0 is confirmed vulnerable. Older and newer versions require verification against the Eleveo advisory—no specific version range is disclosed in available reporting. Organizations should audit deployments immediately and contact Eleveo directly for guidance on affected versions, as the vendor has not responded to initial disclosure attempts.

Exploitability

Exploitability is high in practical terms: the vulnerability requires only standard user-level credentials (no zero-click scenario), network accessibility to the application, and straightforward parameter manipulation. Public exploit code is documented as available, reducing the technical barrier for attackers. The attack leaves minimal forensic evidence if role assignments are not closely monitored. However, active exploitation requires the attacker to first obtain legitimate credentials through compromise, phishing, or insider access.

Remediation

Eleveo has not released a confirmed patch as of the latest advisory update (2026-07-13). Organizations must immediately contact Eleveo support for patch availability and timelines. Interim mitigations include: (1) restrict network access to the /callrec/userAddAction.do endpoint using firewall rules or VPN requirements; (2) implement robust logging and alerting on role modification events; (3) audit all user accounts and roles for unauthorized privilege escalation; (4) disable inactive user accounts; and (5) enforce principle of least privilege for system administrator functions.

Patch guidance

No vendor patch has been announced as of the modification date. Verify directly with Eleveo regarding patch status, expected release date, and affected version scope. When a patch becomes available, test it thoroughly in a non-production environment before deployment, as authorization changes can impact critical workflows. Subscribe to Eleveo's security advisories and monitor their support portal for updates.

Detection guidance

Monitor application logs for suspicious patterns: repeated calls to /callrec/userAddAction.do with role parameters differing from the caller's current role, creation of new user accounts with administrative roles by non-administrative users, or role changes for existing accounts outside scheduled maintenance windows. Implement SIEM rules to flag any role assignment by accounts lacking explicit privilege delegation. Review web access logs for unusual sequences of user management API calls. Conduct quarterly user access reviews to detect orphaned or improperly privileged accounts.

Why prioritize this

Although the CVSS score is MEDIUM, this vulnerability warrants elevated priority because: (1) public exploits are available, shortening the reaction window; (2) the vendor is unresponsive, leaving no clear remediation path; (3) privilege escalation undermines access controls across the entire application; (4) call recording systems often contain sensitive personal and business data; and (5) successful exploitation can enable persistent backdoors or compliance violations. Organizations should treat this as high-priority until patch availability and mitigation options are clarified.

Risk score, explained

The CVSS v3.1 score of 6.3 (MEDIUM) reflects a network-accessible vulnerability requiring low privileges and low complexity to exploit. Confidentiality, integrity, and availability impacts are all rated low in the scoring vector (CvssAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). However, in practice, the impact may exceed this score within specific organizations: a compromised low-privilege account that escalates to admin access can lead to high-severity consequences. The MEDIUM rating reflects worst-case systemic damage; individual deployments should evaluate based on data sensitivity and user trust model.

Frequently asked questions