CVE-2026-15376

MEDIUM

Eleveo Call Recording Software statisticReportAction.do improper authorization

Title source: cna

Description

A vulnerability was found in Eleveo Call Recording Software 9.7.0. Affected is an unknown function of the file /callrec/statisticReportAction.do. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (6)

Core 6

Core References

Third Party Advisory third-party-advisory

CVE-2026-15376 | CVE Analysis and Report

https://vuldb.com/cve/CVE-2026-15376

Third Party Advisory third-party-advisory

Submit #797461 | Eleveo Call Recording 9.7.0 Broken Access Control

https://vuldb.com/submit/797461

Exploit exploit

https://drive.google.com/file/d/18l6-Lpvqq1B-ureww1zR5d_nyhZl312q/view?usp=sharing

Vdb Entry vdb-entry

VDB-377443 | Eleveo Call Recording Software statisticReportAction.do improper authorization

https://vuldb.com/vuln/377443

Signature, Permissions Required signature permissions-required

VDB-377443 | CTI Indicators (IOB, IOC, TTP, IOA)

https://vuldb.com/vuln/377443/cti

Exploit exploit

https://github.com/omarelshopky/cves/tree/main/eleveo/call-recording-software/CVE-2026-15376

View Exploit ZIP pw:eip

Scores

CVSS v3 6.3

EPSS 0.0026

EPSS Percentile 17.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-266 CWE-285

Status published

Products (1)

Eleveo/Call Recording Software 9.7.0

Published Jul 10, 2026

Tracked Since Jul 10, 2026