CVE-2026-85408
Received Received - Intake

Eleveo Quality Management Session Hijacking via Conversation Handler

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulDB

Description
A vulnerability was determined in Eleveo Quality Management 9.7.0. Impacted is an unknown function of the file /enc-fwk-data/api/v3/conversations/<ID>/events of the component Conversation Handler. This manipulation of the argument createdBy causes dynamically-determined object attributes. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85408
EUVD
EUVD-2026-70882

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
eleveo quality_management 9.7.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-915 The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
CWE-913 The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in Eleveo Quality Management 9.7.0. It involves a manipulation in the Conversation Handler component, specifically in the file path /enc-fwk-data/api/v3/conversations/<ID>/events. The issue arises from the 'createdBy' argument, which can cause dynamically-determined object attributes to be altered. The attack can be executed remotely and has been publicly disclosed.

Detection Guidance

Detection of CVE-2026-85408 requires monitoring for unusual activity in the Eleveo Quality Management system, particularly in the /enc-fwk-data/api/v3/conversations/<ID>/events endpoint. Check for unexpected modifications to the 'createdBy' parameter or dynamically altered object attributes. Review server logs for POST requests to this path with suspicious payloads.

Impact Analysis

The impact includes unauthorized modification of object attributes within the application. This could lead to data integrity issues, such as incorrect records or logs, potentially affecting business operations. The remote attack vector means attackers do not need direct access to the system.

Compliance Impact

This vulnerability may impact compliance by compromising data integrity, which is critical under GDPR and HIPAA. Unauthorized changes to records could violate integrity requirements, leading to potential legal and regulatory penalties. However, specific compliance impacts depend on the data processed by the affected system.

Mitigation Strategies

Immediately restrict access to the vulnerable endpoint /enc-fwk-data/api/v3/conversations/<ID>/events. Update Eleveo Quality Management to the latest patched version if available. Monitor network traffic for unusual activity targeting this path. Consider disabling the Conversation Handler component if not essential.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85408. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart