CVE-2026-15373: Eleveo Call Recording Auth Bypass Flaw

CVE-2026-15373 Overview

CVE-2026-15373 is an improper authorization vulnerability in Eleveo Call Recording Software version 9.7.0. The flaw resides in an unspecified function of the /callrec/userAddAction.do endpoint. Attackers can manipulate the role argument to bypass authorization controls and influence user role assignment. The attack is executable remotely over the network and requires low privileges. Public exploit details are available, and the vendor did not respond to the initial disclosure attempt. The weakness is classified under [CWE-266] Incorrect Privilege Assignment.

Critical Impact
Authenticated remote attackers can tamper with the role parameter submitted to /callrec/userAddAction.do to elevate or alter user privileges within the call recording platform.

Affected Products

Eleveo Call Recording Software 9.7.0
/callrec/userAddAction.do endpoint
Deployments exposing the callrec web application to authenticated users

Discovery Timeline

2026-07-10 - CVE-2026-15373 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-15373

Vulnerability Analysis

The vulnerability affects the user administration workflow in Eleveo Call Recording Software 9.7.0. The /callrec/userAddAction.do action processes a role parameter without enforcing sufficient authorization checks on the requesting principal. An authenticated user with low privileges can submit a crafted request that specifies an elevated role, and the server accepts the value without validating that the caller is permitted to assign that role. This misalignment between authentication and authorization enables privilege changes outside the intended administrative boundary. The CWE-266 classification reflects incorrect privilege assignment rather than a missing authentication requirement.

Root Cause

The root cause is inadequate server-side authorization on the userAddAction.do handler. The application trusts the client-supplied role value and does not verify that the session holder has the administrative right to grant that role. Access control is applied at the endpoint reachability level, not at the field level for the sensitive role attribute.

Attack Vector

The attack vector is network-based. An attacker who already holds valid low-privilege credentials submits an HTTP request to /callrec/userAddAction.do with the role parameter set to a higher-privilege value. No user interaction is required. A public proof of concept is referenced by the GitHub PoC Repository and the VulDB Vulnerability Entry.

No verified exploit code is republished here. Refer to the referenced repositories for request structure and parameter details.

Detection Methods for CVE-2026-15373

Indicators of Compromise

HTTP POST requests to /callrec/userAddAction.do containing a role parameter that grants elevated privileges.
User accounts whose role attribute changes without a corresponding administrator-initiated action in the audit log.
Requests to userAddAction.do originating from sessions belonging to non-administrative users.

Detection Strategies

Correlate web server access logs for /callrec/userAddAction.do with the authenticated user's known role, and alert on privilege mismatch.
Monitor Eleveo application audit trails for role assignment events that lack a corresponding administrative session context.
Deploy web application firewall rules that inspect the role parameter and flag values inconsistent with the caller's session.

Monitoring Recommendations

Enable verbose logging on the callrec user administration module and forward logs to a central SIEM.
Track creation and modification of privileged accounts across the call recording platform on an hourly cadence.
Alert on any use of userAddAction.do outside expected administrative source addresses.

How to Mitigate CVE-2026-15373

Immediate Actions Required

Restrict network access to /callrec/userAddAction.do so that only administrative source addresses can reach the endpoint.
Review all user accounts in Eleveo Call Recording Software 9.7.0 for unauthorized role changes and revert unexpected privileges.
Rotate credentials for accounts that may have been used to abuse the authorization flaw.

Patch Information

As of the last NVD update on 2026-07-13, the vendor did not respond to the disclosure and no official patch has been referenced in the VulDB CVE Entry. Monitor Eleveo vendor channels for a fixed release and apply it as soon as it is available.

Workarounds

Place the callrec application behind a reverse proxy that enforces administrative role checks on requests to userAddAction.do.
Apply strict web application firewall rules to reject requests where the role parameter is set by non-administrative sessions.
Limit account provisioning to a dedicated administrative jump host and disable low-privilege access to the user management interface.

bash

# Example NGINX restriction for the vulnerable endpoint
location = /callrec/userAddAction.do {
    allow 10.0.0.0/24;   # admin subnet
    deny  all;
    proxy_pass http://callrec_backend;
}