CVE-2026-85408
MediumCVSS 4.3Summary
A vulnerability was determined in Eleveo Quality Management 9.7.0 in the Conversation Handler component, specifically in the file /enc-fwk-data/api/v3/conversations/<ID>/events. Manipulation of the createdBy argument causes dynamically-determined object attributes. The attack can be performed remotely. The exploit is public, and the vendor did not respond.
Risk Assessment
The risk includes potential unauthorized data modification or privilege escalation through manipulation of object attributes.
Recommendation
It is recommended to restrict access to the Conversation Handler API and implement input validation. Also, monitor activity and contact the vendor.
Other vulnerabilities in Eleveo Quality Management
See all- CVE-2026-85409Medium
A path traversal vulnerability was identified in Eleveo Quality Management 9.7.0 in the function QuestionnaireService.runDataExportNow of the Questionnaire Service component. Manipulation of the file_name argument leads to path traversal. The attack can be performed remotely. The exploit is publicly available, and the vendor did not respond.
- CVE-2026-85407Medium
A vulnerability was found in Eleveo Quality Management 9.7.0 in the Conversation Handler component, specifically in the file /enc-fwk-data/api/v3/conversations/<ID>/events. Manipulation of the labels argument results in denial of service. The attack can be executed remotely. The exploit is public, and the vendor did not respond.
- CVE-2026-85406Low
A vulnerability in Eleveo Quality Management 9.7.0 affects unknown code of the Conversation Review component. Manipulation leads to cross site scripting (XSS). Remote exploitation is possible, and the exploit has been publicly disclosed.
Original NVD description (English source)
A vulnerability was determined in Eleveo Quality Management 9.7.0. Impacted is an unknown function of the file /enc-fwk-data/api/v3/conversations/<ID>/events of the component Conversation Handler. This manipulation of the argument createdBy causes dynamically-determined object attributes. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.