CVE-2026-15376: Eleveo Call Recording 9.7.0 Authorization Bypass

Technical summary

The vulnerability resides in the /callrec/statisticReportAction.do endpoint and stems from improper authorization controls (CWE-266: Improper Privilege Management, CWE-285: Improper Authorization). An authenticated user can manipulate requests to this function to bypass access restrictions, gaining unauthorized read and write capabilities. The attack requires valid login credentials and network access to the application; no user interaction is needed once authenticated. The CVSS 3.1 score of 6.3 reflects moderate severity: network accessibility, low attack complexity, low privileges required, and impacts to confidentiality, integrity, and availability.

Business impact

Organizations relying on Eleveo for call recording face three concurrent risks: unauthorized access to sensitive call logs and metadata, potential tampering with reporting data used for compliance and analytics, and possible data exfiltration of confidential customer communications. In regulated industries (financial services, healthcare), compromised call recordings can trigger compliance violations and reputational harm. The absence of vendor responsiveness creates an indefinite window of exposure.

Affected systems

Eleveo Call Recording Software version 9.7.0 is confirmed affected. Organizations should verify whether they operate this specific version and determine if the vulnerable endpoint is exposed to authenticated users—particularly contractors, partners, or accounts with lower privilege levels who could pivot toward sensitive data.

Exploitability

Exploitability is high in practical terms: public exploit code exists, attack complexity is minimal, and the barrier to entry is simply valid authentication credentials. Insider threats and compromised accounts become immediate attack vectors. The attack leaves authentication logs but may be difficult to distinguish from legitimate reporting queries without endpoint monitoring.

Remediation

The immediate mitigation is upgrading to a patched release from Eleveo; verify the latest version via the vendor's official channels or contact their support directly. If immediate patching is unavailable, restrict network access to the /callrec/statisticReportAction.do endpoint via firewall or WAF rules, limit user accounts with reporting access to those with documented business need, and implement robust logging and alerting on statisticReportAction requests.

Patch guidance

Contact Eleveo directly or check their security advisories for available patches beyond version 9.7.0. Given the vendor's non-responsiveness noted in the CVE record, verify patch availability and timeline independently. Organizations should document any patch testing thoroughly before deployment to call recording systems.

Detection guidance

Monitor for repeated or anomalous requests to /callrec/statisticReportAction.do, especially from accounts that do not typically access reporting functions or outside normal business hours. Review Eleveo application logs for authorization failures followed by successful requests. Correlate authentication logs with endpoint access to detect credential misuse. Network IDS/IPS rules targeting this path may reduce detection latency.

Why prioritize this

Assign this vulnerability medium-to-high priority if you run Eleveo 9.7.0 with external or untrusted user access. The combination of public exploits, credential-based attack surface, and vendor non-responsiveness justifies rapid assessment and containment. If the instance is air-gapped or accessed only by trusted internal staff with strong authentication, priority may be lower; however, call recording systems often handle regulated data, elevating overall risk.

Risk score, explained

The CVSS 3.1 base score of 6.3 (Medium) reflects a remotely exploitable vulnerability requiring valid credentials, with direct impacts to three security properties (CIA). However, real-world risk is amplified by public exploit availability, vendor unresponsiveness, and the sensitivity of call recording data in compliance contexts. Organizations should consider this a High priority relative to their own risk appetite and regulatory obligations.

Frequently asked questions