CVE-2026-15473

Eleveo Call Recording Software Recorded Calls restoreCallAction.do improper authorization

View on CVE.org
Published Jul 12, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This issue affects some unknown processing of the file /callrec/restoreCallAction.do of the component Recorded Calls Page. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

The vulnerability in Eleveo Call Recording Software version 9.7.0 allows remote attackers to exploit the /callrec/restoreCallAction.do endpoint and bypass the application’s authorization checks. By manipulating requests to this endpoint, an attacker can restore or view call recordings without proper permission, exposing confidential audio data and compromising the privacy of users. This flaw corresponds to CWE-266 (Improper Privilege Assignment) and CWE-285 (Improper Authorization).

Affected Systems

Eleveo Call Recording Software, version 9.7.0, is affected by this authorization flaw. No other versions were identified as vulnerable in the available information.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity, while an EPSS score of less than 1% suggests that the likelihood of exploitation is currently low. Nonetheless, the attack is possible to be carried out remotely and the exploit code is publicly available. The vulnerability is not listed in CISA’s KEV catalog. The overall risk remains moderate, and organizations should treat it as a potential threat to confidentiality and integrity of recorded data.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑supplied patch or upgrade Eleveo Call Recording Software to a version that fixes the authorization issue.
  • Restrict remote access to the /callrec/restoreCallAction.do URL with firewall or network segmentation so that only authenticated users with the appropriate roles can reach it.
  • Review and enforce role‑based authorization checks within the Recorded Calls component to block unauthorized usage.

Generated by OpenCVE AI on August 1, 2026 at 11:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This issue affects some unknown processing of the file /callrec/restoreCallAction.do of the component Recorded Calls Page. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Eleveo Call Recording Software Recorded Calls restoreCallAction.do improper authorization
First Time appeared Eleveo
Eleveo call Recording Software
Weaknesses CWE-266
CWE-285
CPEs cpe:2.3:a:eleveo:call_recording_software:*:*:*:*:*:*:*:*
Vendors & Products Eleveo
Eleveo call Recording Software
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-285

    Improper Authorization

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Jul 14, 2026, 2:34 PM
Reserved
Jul 11, 2026, 9:33 AM

View source JSON

Updated
Jul 14, 2026, 2:33 PM

JSON

Status
Deferred
Published
Jul 12, 2026, 3:16 AM
Modified
Oct 25, 2026, 3:10 PM

View source JSON

No data.

Updated
Aug 1, 2026, 11:30 AM

JSON