CVE-2026-15377: Eleveo Call Recording Software Authorization Bypass Vulnerability

Technical summary

CVE-2026-15377 is an improper authorization vulnerability (CWE-266, CWE-285) in the /callrec/sendlogfile file handler of Eleveo Call Recording Software 9.7.0. The flaw permits an authenticated attacker to bypass authorization controls and read sensitive information. With a CVSS 3.1 score of 4.3 (Medium), the attack requires network access and valid credentials but no user interaction. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog, though public disclosure has occurred.

Business impact

An insider or low-privilege user with valid system credentials could access confidential call logs or related metadata not ordinarily available to them. This may violate data governance policies, expose sensitive customer interactions, or breach regulatory compliance requirements in regulated industries (finance, healthcare, contact centers). The impact is primarily informational—no data corruption or service disruption—but could enable privacy violations or competitive intelligence gathering.

Affected systems

Eleveo Call Recording Software version 9.7.0 is confirmed affected. Versions prior to or after 9.7.0 have not been documented as vulnerable; contact Eleveo to confirm the scope of affected releases and obtain patches. Organizations running call recording systems based on Eleveo should immediately verify their installed version.

Exploitability

The vulnerability requires valid authentication credentials, reducing the attack surface compared to unauthenticated flaws. However, once a user is authenticated (internal staff, contractors, compromised accounts), exploitation is straightforward and requires no special techniques or user interaction. Public disclosure and available exploit code lower the barrier to exploitation, making this a moderate concern even with the authentication requirement.

Remediation

Immediately contact Eleveo for a patched version of Call Recording Software that addresses CVE-2026-15377. The vendor did not provide a response to early disclosure, so check their official website or support portal for security updates. If patches are unavailable or delayed, implement network-level access controls to restrict which internal systems can reach the /callrec/sendlogfile endpoint and monitor logs for suspicious data access patterns from low-privilege accounts.

Patch guidance

Verify the latest available version of Eleveo Call Recording Software against the official vendor advisory or security release notes to confirm the patch is included. Apply the update in a staging environment first to validate compatibility with your call recording infrastructure. Once validated, schedule updates during maintenance windows to avoid service disruption. If the vendor has not released a patch, escalate internally and request a timeline from Eleveo support.

Detection guidance

Monitor access logs for repeated or unusual requests to the /callrec/sendlogfile endpoint, particularly from low-privilege user accounts or service accounts. Look for HTTP requests where the authenticated user is accessing call logs outside their normal job function. Implement logging on file access within the Eleveo application if available. Use User and Entity Behavior Analytics (UEBA) to flag anomalous data access patterns. Review authentication and authorization audit trails for any privilege escalation or lateral movement preceding log file access.

Why prioritize this

Although the CVSS score is moderate (4.3), this vulnerability warrants prioritization because: (1) it has been publicly disclosed with available exploits, increasing active exploitation risk; (2) the vendor's non-responsiveness to early disclosure signals delayed or absent patches; (3) call recording systems typically contain highly sensitive data subject to regulatory requirements; (4) insider threats and compromised internal accounts are prevalent attack vectors where this flaw becomes readily exploitable. Organizations in regulated industries should patch urgently.

Risk score, explained

The CVSS 3.1 score of 4.3 (Medium) reflects low confidentiality impact (C:L), no integrity or availability impact (I:N/A:N), and a relatively low attack vector requiring valid authentication (PR:L). However, the business context—sensitive call logs, regulatory exposure, public exploit availability, and vendor non-responsiveness—elevates practical risk above the numerical score. This is a case where business context and threat landscape should drive prioritization above the base CVSS metric alone.

Frequently asked questions