CVE-2026-15374
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A flaw in Eleveo Call Recording Software 9.7.0 affects the file /callrec/roleAddAction.do in the Group Interface component. Manipulation can lead to improper authorization. The attack can be launched remotely and the exploit has been published.
Risk Assessment
The organization is at risk of unauthorized access to role management functions, potentially leading to privilege escalation and data confidentiality breaches.
Recommendation
Immediately block access to /callrec/roleAddAction.do via firewall or WAF, and contact the vendor for a patch.
Other vulnerabilities in Eleveo Call Recording Software
See all- CVE-2026-15474Medium
An improper authorization vulnerability has been discovered in Eleveo Call Recording Software 9.7.0. The unknown function in the /callrec/audio.jsp file fails to properly validate permissions for the callId parameter, allowing unauthorized access. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-15472Medium
A vulnerability was found in Eleveo Call Recording Software 9.7.0 in the file /callrec/composeEmailAction.do. Unknown code allows remote manipulation leading to improper authorization. The exploit has been publicly disclosed and may be used.
- CVE-2026-15471Medium
A vulnerability in Eleveo Call Recording Software 9.7.0 was found in the /callrec/pci_dss_status.jsp file, allowing unauthorized access. The attack can be performed remotely and the exploit has been made public. The vendor did not respond to the disclosure.
- CVE-2026-15470Medium
A vulnerability was found in Eleveo Call Recording Software 9.7.0 in the file /callrec/group.jsp. An unknown functionality leads to improper authorization, which can be exploited remotely. The exploit has been publicly disclosed and may be used.
- CVE-2026-15377Medium
A vulnerability was found in Eleveo Call Recording Software 9.7.0 in the file /callrec/sendlogfile. An unknown functionality causes improper authorization, allowing remote attacks. The exploit has been publicly disclosed and may be used.
- CVE-2026-15376Medium
A vulnerability in Eleveo Call Recording Software 9.7.0 affects the file /callrec/statisticReportAction.do. An unknown function leads to improper authorization, allowing remote exploitation. The exploit is public, and the vendor did not respond.
- CVE-2026-15375Medium
A vulnerability was found in Eleveo Call Recording Software 9.7.0 in the file /callrec/users_ldap.jsp of the LDAP User Interface component. An unknown function leads to improper authorization, exploitable remotely. The exploit has been publicly disclosed.
- CVE-2026-15373Medium
A vulnerability was found in Eleveo Call Recording Software 9.7.0 in the file /callrec/userAddAction.do. An unknown function improperly authorizes the role argument, allowing unauthorized actions. The attack can be performed remotely and the exploit is publicly available.
Original NVD description (English source)
A flaw has been found in Eleveo Call Recording Software 9.7.0. This affects an unknown function of the file /callrec/roleAddAction.do of the component Group Interface. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.