CVE-2026-101146

Received Received - Intake

Information Disclosure in Eleveo Quality Management 9.7.0

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: VulDB

Description

A security flaw has been discovered in Eleveo Quality Management 9.7.0. This issue affects the function UtilsService.createAndSaveAudit of the file /qm/cz.zoom.scorecard.webui.Scorecard/QMUtilsService of the component GWT RPC Handler. Performing a manipulation results in information disclosure. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-28

Last Modified

2026-09-28

Generated

2026-09-29

AI Q&A

2026-09-29

EPSS Evaluated

N/A

NVD

CVE-2026-101146

Affected Vendors & Products

Vendor	Product	Version / Range
eleveo	quality_management	9.7.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability is an information disclosure flaw in Eleveo Quality Management 9.7.0. It exists in the UtilsService.createAndSaveAudit function within the /qm/cz.zoom.scorecard.webui.Scorecard/QMUtilsService component. The issue allows remote attackers to access sensitive data due to improper handling of GWT RPC requests.

Impact Analysis

The vulnerability may allow unauthorized access to confidential information stored in the system. Since the exploit is publicly available and the vendor did not respond to disclosure, attackers could actively target systems running the affected version. Impact includes potential data breaches and loss of sensitive business or user data.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized data exposure. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A breach may result in legal penalties, fines, and reputational damage for organizations handling regulated data.

Mitigation Strategies

Immediately update Eleveo Quality Management to the latest patched version if available. If no patch exists, restrict network access to the vulnerable component /qm/cz.zoom.scorecard.webui.Scorecard/QMUtilsService and monitor for unusual activity.

Hi! I’m here to help you understand CVE-2026-101146. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70