CVE-2026-15374: Eleveo Call Recording Auth Bypass Flaw

CVE-2026-15374 Overview

CVE-2026-15374 is an improper authorization vulnerability in Eleveo Call Recording Software version 9.7.0. The flaw resides in an unspecified function within the /callrec/roleAddAction.do endpoint of the Group Interface component. An authenticated remote attacker with low privileges can manipulate the request to bypass authorization controls and perform actions outside their assigned role scope. A public proof-of-concept exploit has been published. The vendor was contacted prior to public disclosure but did not respond. The weakness is categorized under [CWE-266] Incorrect Privilege Assignment.

Critical Impact
Authenticated remote attackers can abuse the roleAddAction.do endpoint to escalate privileges or modify role assignments outside their authorization boundary.

Affected Products

Eleveo Call Recording Software 9.7.0
Group Interface component (/callrec/roleAddAction.do)
Deployments exposing the callrec web application to untrusted networks

Discovery Timeline

2026-07-10 - CVE-2026-15374 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-15374

Vulnerability Analysis

The vulnerability affects the roleAddAction.do handler in the Group Interface of Eleveo Call Recording Software 9.7.0. The endpoint fails to enforce sufficient authorization checks before executing role management logic. An authenticated user with limited privileges can submit crafted requests that the server processes without validating whether the caller holds the necessary role management permission. This mismatch between the caller's actual privilege level and the operation performed constitutes an improper authorization condition mapped to [CWE-266].

The exploit is publicly available in a GitHub proof-of-concept repository, increasing the likelihood of opportunistic scanning against exposed deployments. Because call recording platforms typically retain sensitive voice data, unauthorized role manipulation may cascade into broader access to recorded communications, user management functions, and audit configuration.

Root Cause

The root cause is missing or insufficient server-side authorization enforcement on the roleAddAction.do action. The handler relies on session authentication but does not verify that the authenticated principal is permitted to invoke role-modifying operations on the target group.

Attack Vector

Exploitation occurs over the network against the web interface. The attacker requires valid low-privilege credentials to reach the authenticated endpoint. Once authenticated, the attacker issues a manipulated HTTP request to /callrec/roleAddAction.do to trigger the flaw. No user interaction from a privileged operator is required. Refer to the GitHub PoC Repository and the VulDB Vulnerability Detail for the request structure and reproduction steps.

No verified code samples are published in the enriched dataset. Technical readers should consult the linked proof-of-concept for the exact HTTP request pattern.

Detection Methods for CVE-2026-15374

Indicators of Compromise

HTTP POST requests to /callrec/roleAddAction.do originating from user accounts that do not normally perform role administration.
Unexpected creation or modification of roles and group assignments in Eleveo administrative audit logs.
Sessions from low-privilege accounts issuing requests to administrative action endpoints within short time windows.

Detection Strategies

Correlate web server access logs with application role change events to flag mismatches between the caller's role and the action performed.
Alert on any invocation of roleAddAction.do where the authenticated user lacks documented administrator privileges.
Baseline normal administrator source addresses and flag role management requests from unexpected IP ranges or user agents.

Monitoring Recommendations

Forward Eleveo Call Recording application logs and reverse proxy access logs to a centralized SIEM for retention and correlation.
Enable verbose auditing on the Group Interface so that every role addition records the requesting user, timestamp, and target group.
Review the VulDB CTI Information periodically for updated exploitation indicators.

How to Mitigate CVE-2026-15374

Immediate Actions Required

Restrict network access to the /callrec/ web interface so that only trusted management networks can reach role administration endpoints.
Audit existing role and group assignments in the call recording platform and revert any unauthorized changes.
Rotate credentials for all low-privilege accounts and enforce strong authentication for administrative users.
Monitor the VulDB CVE Record and vendor channels for a forthcoming patch.

Patch Information

No vendor patch is referenced in the enriched data. According to the disclosure, the vendor was contacted early but did not respond. Operators should track the VulDB CVE Record and Eleveo support communications for a fix and apply it as soon as it becomes available.

Workarounds

Place the call recording web application behind a reverse proxy or web application firewall and block direct external requests to roleAddAction.do.
Apply proxy-level authorization rules that require an administrative group claim before forwarding requests to role management endpoints.
Reduce the number of accounts with access to the Group Interface to the minimum necessary for operations.

bash

# Example NGINX rule to restrict roleAddAction.do to a management subnet
location = /callrec/roleAddAction.do {
    allow 10.10.20.0/24;   # management network
    deny  all;
    proxy_pass http://callrec_backend;
}