CVE-2026-15374: Eleveo Call Recording Software Authorization Flaw

Technical summary

CVE-2026-15374 is an improper authorization vulnerability (CWE-266, CWE-285) affecting Eleveo Call Recording Software 9.7.0. The flaw exists in the Group Interface component, specifically the /callrec/roleAddAction.do endpoint. An authenticated attacker can manipulate this function to circumvent authorization checks, resulting in unauthorized access or actions. The attack vector is network-accessible, requires low complexity, and necessitates valid authentication credentials (PR:L). The vulnerability carries a CVSS v3.1 score of 6.3 (MEDIUM severity) with potential impact to confidentiality, integrity, and availability.

Business impact

This vulnerability enables privilege escalation and lateral movement within Eleveo deployments. Authenticated users—including those with minimal privileges—could manipulate group role assignments or access controls, potentially affecting call recording configurations, audit trails, and data access policies. In multi-tenant or regulated environments, unauthorized role manipulation could compromise compliance postures, expose sensitive call data, or allow attackers to obscure their activities. Organizations relying on Eleveo's access controls for enforcement of data governance face direct risk.

Affected systems

Eleveo Call Recording Software version 9.7.0 is confirmed affected. Organizations running this version should assume they are at risk. Verify your installed version against your license or administrative interface. Earlier and later versions may also be affected; contact Eleveo or consult their security advisories for comprehensive version coverage. The vendor did not respond to early disclosure, so formal vendor guidance may be limited.

Exploitability

Public exploit code is available, reducing the barrier to weaponization. The attack requires valid credentials, which limits scope to insider threats or attackers with prior access compromise. Network accessibility and low complexity mean that anyone with valid authentication can launch the attack without complex prerequisites or user interaction. The combination of public exploit availability and low authentication barrier makes this vulnerability practically exploitable in real-world scenarios.

Remediation

Immediately verify your Eleveo Call Recording Software version. If running 9.7.0, prioritize patching to a patched version as soon as available from the vendor. Because the vendor did not respond to early disclosure, check Eleveo's official security advisories or website for patch availability and compatibility details. In the interim, implement network segmentation to restrict access to the /callrec/roleAddAction.do endpoint, enforce strong access controls, and monitor for suspicious role or group modification attempts.

Patch guidance

Contact Eleveo directly or monitor their official security page for patch releases addressing CVE-2026-15374. Verify patch version numbers and compatibility with your deployment before applying. Given the vendor's lack of response during disclosure, patches may be delayed; establish a timeline for remediation and communicate interim mitigations to stakeholders. Test patches in a non-production environment first to ensure compatibility with your call recording workflows.

Detection guidance

Monitor authentication logs for unusual authentication patterns, especially from service accounts or low-privilege users. Track HTTP requests to /callrec/roleAddAction.do for POST or manipulation attempts with unexpected parameters. Alert on successful group or role modifications initiated by non-administrative accounts or outside normal change windows. Review Eleveo access logs for unauthorized changes to role assignments, group memberships, or permission configurations. Implement baseline logging of all /callrec/ endpoint activity if not already enabled.

Why prioritize this

Although unranked on CISA's KEV catalog, this vulnerability warrants prompt attention due to public exploit availability, the relative ease of exploitation (authenticated access only), and the severity of the authorization flaw. In call recording systems—often subject to regulatory requirements—unauthorized role manipulation poses compliance and data governance risks. The vendor's non-responsiveness increases uncertainty about patch timelines, making proactive remediation essential.

Risk score, explained

The CVSS v3.1 score of 6.3 (MEDIUM) reflects the attack's network accessibility, low complexity, and impact to confidentiality, integrity, and availability. However, the score's reliance on the PR:L (Privileged Required: Low) parameter may understate risk in environments where service accounts are numerous or credential compromise is common. The presence of public exploit code elevates practical risk beyond the base CVSS metric. Organizations with strong privileged access management (PAM) can mitigate some risk; those without should treat this as MEDIUM-HIGH.

Frequently asked questions