CVE-2026-15474

Deferred Deferred - Pending Action

Authorization Bypass in Eleveo Call Recording Software

Publication date: 2026-07-12

Last updated on: 2026-07-16

Assigner: VulDB

Description

A security flaw has been discovered in Eleveo Call Recording Software 9.7.0. Impacted is an unknown function of the file /callrec/audio.jsp of the component Call Recording Handler. The manipulation of the argument callId results in improper authorization. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-12

Last Modified

2026-07-16

Generated

2026-08-01

AI Q&A

2026-07-12

EPSS Evaluated

2026-07-31

NVD

CVE-2026-15474

EUVD

EUVD-2026-43196

Affected Vendors & Products

Vendor	Product	Version / Range
eleveo	call_recording_software	9.7.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-266	A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is a security flaw in Eleveo Call Recording Software version 9.7.0, specifically in the Call Recording Handler component within the file /callrec/audio.jsp. It involves improper authorization caused by manipulation of the callId argument. An attacker can exploit this flaw remotely to bypass authorization controls.

Detection Guidance

This vulnerability involves improper authorization via manipulation of the callId argument in the /callrec/audio.jsp file of Eleveo Call Recording Software 9.7.0. Detection would typically involve monitoring for unauthorized or suspicious HTTP requests targeting this endpoint.

Suggested detection methods include inspecting web server logs or using network monitoring tools to identify requests to /callrec/audio.jsp with unusual or unexpected callId parameters.

Specific commands are not provided in the available information.

Impact Analysis

The vulnerability allows an attacker to perform unauthorized actions remotely by manipulating the callId parameter. This could lead to unauthorized access to call recordings or related data handled by the software. Since the exploit is publicly available, it increases the risk of attacks against affected systems.

Mitigation Strategies

Immediate mitigation steps are not explicitly detailed in the provided information.

General best practices would include restricting access to the vulnerable endpoint, implementing proper authorization checks, and monitoring for exploit attempts.

Since the vendor has not responded and no patch is mentioned, consider isolating the affected system or applying network-level controls to limit exposure.

Hi! I’m here to help you understand CVE-2026-15474. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70