Description
A vulnerability has been found in Eleveo Call Recording Software 9.7.0. This impacts an unknown function of the file /callrec/users_ldap.jsp of the component LDAP User Interface. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-07-10
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in Eleveo Call Recording Software 9.7.0’s users_ldap.jsp allows attackers to manipulate requests and bypass authorization checks, potentially granting unintended access to LDAP resources; the weakness stems from insufficient privilege controls (CWE‑266) and improper authorization (CWE‑285). Successful exploitation could let an attacker view or modify LDAP entries, undermining confidentiality and integrity.

Affected Systems

The vulnerability exists in Eleveo Call Recording Software version 9.7.0. The affected component is the LDAP User Interface, specifically the users_ldap.jsp resource, which is part of the standard installation and not limited to any particular deployment scenario.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The attack can be initiated remotely by sending crafted requests to the LDAP User Interface; no special conditions are described, so based on the description it is inferred that any system exposing the interface to untrusted networks may be at risk.

Generated by OpenCVE AI on July 29, 2026 at 10:45 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply vendor‑issued patch or upgrade to a version that includes the fix once available.
  • Bind the LDAP User Interface to trusted internal networks and restrict public access to the interface.
  • Implement or enforce role‑based access control and strong authentication before allowing LDAP queries, ensuring only authorized users can access the LDAP interface.

Generated by OpenCVE AI on July 29, 2026 at 10:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 14 Jul 2026 02:30:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 13 Jul 2026 17:15:00 +0000

Type Values Removed Values Added
References

Mon, 13 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Eleveo call Recording
Vendors & Products Eleveo call Recording

Fri, 10 Jul 2026 15:45:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in Eleveo Call Recording Software 9.7.0. This impacts an unknown function of the file /callrec/users_ldap.jsp of the component LDAP User Interface. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Eleveo Call Recording Software LDAP User users_ldap.jsp improper authorization
First Time appeared Eleveo
Eleveo call Recording Software
Weaknesses CWE-266
CWE-285
CPEs cpe:2.3:a:eleveo:call_recording_software:*:*:*:*:*:*:*:*
Vendors & Products Eleveo
Eleveo call Recording Software
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Eleveo Call Recording Call Recording Software
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-14T01:52:31.281Z

Reserved: 2026-07-10T08:47:14.350Z

Link: CVE-2026-15375

cve-icon Vulnrichment

Updated: 2026-07-14T01:52:27.227Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-29T11:00:13Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-285

    Improper Authorization