Description
A security flaw has been discovered in Eleveo Quality Management 9.7.0. This issue affects the function UtilsService.createAndSaveAudit of the file /qm/cz.zoom.scorecard.webui.Scorecard/QMUtilsService of the component GWT RPC Handler. Performing a manipulation results in information disclosure. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-09-28
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Assess
AI Analysis

Impact

A flaw exists in Eleveo Quality Management 9.7.0 within the UtilsService.createAndSaveAudit method of a GWT RPC handler. By sending a crafted request to the /qm/cz.zoom.scorecard.webui.Scorecard/QMUtilsService endpoint, an attacker can trigger the disclosure of internal audit information that should not be publicly available. Based on the description, it is inferred that the flaw does not explicitly require authentication, though the exact access control model is not provided. The vulnerability is classified as CWE-200 (Information Exposure) and CWE-284 (Improper Access Control).

Affected Systems

Eleveo Quality Management 9.7.0. No other vendor or product versions are listed as affected in the available data.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, but the publicly released exploit suggests that attackers could target this flaw with some frequency. The vulnerability is not yet listed in CISA KEV. The attack can be carried out remotely, and because no authentication is explicitly required, the potential for exploitation is higher than for a locally limited flaw. Overall risk remains moderate to high due to the possible compromise of confidential audit data.

Generated by OpenCVE AI on September 28, 2026 at 22:29 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest official security patch released by Eleveo for Quality Management 9.7.0 once available.
  • If a patch is not yet available, isolate the GWT RPC endpoint /qm/cz.zoom.scorecard.webui.Scorecard/QMUtilsService behind a firewall or reverse proxy that allows traffic only from trusted IP addresses.
  • Enforce proper authentication and role-based access controls on the GWT RPC service so that only users with appropriate privileges can invoke createAndSaveAudit.

Generated by OpenCVE AI on September 28, 2026 at 22:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 29 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 28 Sep 2026 20:45:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in Eleveo Quality Management 9.7.0. This issue affects the function UtilsService.createAndSaveAudit of the file /qm/cz.zoom.scorecard.webui.Scorecard/QMUtilsService of the component GWT RPC Handler. Performing a manipulation results in information disclosure. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title Eleveo Quality Management GWT RPC QMUtilsService UtilsService.createAndSaveAudit information disclosure
First Time appeared Eleveo
Eleveo quality Management
Weaknesses CWE-200
CWE-284
CPEs cpe:2.3:a:eleveo:quality_management:*:*:*:*:*:*:*:*
Vendors & Products Eleveo
Eleveo quality Management
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Eleveo Quality Management
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-29T13:47:39.888Z

Reserved: 2026-09-28T08:11:34.751Z

Link: CVE-2026-101146

cve-icon Vulnrichment

Updated: 2026-09-29T13:47:34.527Z

cve-icon NVD

Status : Deferred

Published: 2026-09-28T21:17:12.600

Modified: 2026-09-29T18:57:24.350

Link: CVE-2026-101146

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-29T00:15:10Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control