CVE-2026-15472
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A vulnerability was found in Eleveo Call Recording Software 9.7.0 in the file /callrec/composeEmailAction.do. Unknown code allows remote manipulation leading to improper authorization. The exploit has been publicly disclosed and may be used.
Risk Assessment
The organization is at risk of remote authorization bypass, potentially leading to unauthorized access to sensitive data or system functions.
Recommendation
Immediately block access to the /callrec/composeEmailAction.do file at the firewall or web server level and contact the vendor for a patch.
Other vulnerabilities in Eleveo Call Recording Software
See all- CVE-2026-15474Medium
An improper authorization vulnerability has been discovered in Eleveo Call Recording Software 9.7.0. The unknown function in the /callrec/audio.jsp file fails to properly validate permissions for the callId parameter, allowing unauthorized access. The attack can be performed remotely and the exploit is publicly available.
- CVE-2026-15471Medium
A vulnerability in Eleveo Call Recording Software 9.7.0 was found in the /callrec/pci_dss_status.jsp file, allowing unauthorized access. The attack can be performed remotely and the exploit has been made public. The vendor did not respond to the disclosure.
- CVE-2026-15470Medium
A vulnerability was found in Eleveo Call Recording Software 9.7.0 in the file /callrec/group.jsp. An unknown functionality leads to improper authorization, which can be exploited remotely. The exploit has been publicly disclosed and may be used.
- CVE-2026-15377Medium
A vulnerability was found in Eleveo Call Recording Software 9.7.0 in the file /callrec/sendlogfile. An unknown functionality causes improper authorization, allowing remote attacks. The exploit has been publicly disclosed and may be used.
- CVE-2026-15376Medium
A vulnerability in Eleveo Call Recording Software 9.7.0 affects the file /callrec/statisticReportAction.do. An unknown function leads to improper authorization, allowing remote exploitation. The exploit is public, and the vendor did not respond.
- CVE-2026-15375Medium
A vulnerability was found in Eleveo Call Recording Software 9.7.0 in the file /callrec/users_ldap.jsp of the LDAP User Interface component. An unknown function leads to improper authorization, exploitable remotely. The exploit has been publicly disclosed.
- CVE-2026-15374Medium
A flaw in Eleveo Call Recording Software 9.7.0 affects the file /callrec/roleAddAction.do in the Group Interface component. Manipulation can lead to improper authorization. The attack can be launched remotely and the exploit has been published.
- CVE-2026-15373Medium
A vulnerability was found in Eleveo Call Recording Software 9.7.0 in the file /callrec/userAddAction.do. An unknown function improperly authorizes the role argument, allowing unauthorized actions. The attack can be performed remotely and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This vulnerability affects unknown code of the file /callrec/composeEmailAction.do. Executing a manipulation can lead to improper authorization. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.