CVE-2026-101144

Received Received - Intake

Improper Access Control in Eleveo Call Recording Software

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: VulDB

Description

A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/searchAction.do of the component Query Builder. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-28

Last Modified

2026-09-28

Generated

2026-09-29

AI Q&A

2026-09-29

EPSS Evaluated

N/A

NVD

CVE-2026-101144

EUVD

EUVD-2026-88475

Affected Vendors & Products

Vendor	Product	Version / Range
eleveo	call_recording_software	9.7.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-266	A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability is in Eleveo Call Recording Software version 9.7.0, specifically in the /callrec/searchAction.do file. It allows improper access controls due to a flaw in the Query Builder component. The issue enables unauthorized remote access to sensitive data.

Impact Analysis

An attacker could exploit this to gain unauthorized access to call recordings or sensitive information. This may lead to data breaches, privacy violations, or unauthorized modifications to recorded calls. The exploit is publicly available, increasing the risk of attacks.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to personal or health-related data. GDPR requires strict access controls for personal data, while HIPAA mandates safeguards for protected health information. A breach may result in legal penalties and reputational damage.

Mitigation Strategies

Immediately restrict access to the /callrec/searchAction.do endpoint. Update Eleveo Call Recording Software to the latest version if available. Monitor network traffic for unusual queries targeting this path.

Hi! I’m here to help you understand CVE-2026-101144. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70