CVE-2026-15375: Eleveo Auth Bypass Vulnerability

CVE-2026-15375 Overview

CVE-2026-15375 is an improper authorization vulnerability in Eleveo Call Recording Software 9.7.0. The flaw resides in an unspecified function within the /callrec/users_ldap.jsp file, which is part of the LDAP User Interface component. Authenticated attackers with low privileges can exploit the weakness remotely over the network to perform actions outside their authorized scope. The vendor was contacted before public disclosure but did not respond. Proof-of-concept details have been disclosed publicly, increasing the likelihood of exploitation attempts against exposed deployments.

Critical Impact
Authenticated remote attackers can bypass authorization controls in the LDAP User Interface of Eleveo Call Recording Software 9.7.0, potentially exposing sensitive LDAP-related configuration and user data.

Affected Products

Eleveo Call Recording Software 9.7.0
Component: LDAP User Interface (/callrec/users_ldap.jsp)
Deployments exposing the /callrec/ web application to authenticated users

Discovery Timeline

2026-07-10 - CVE-2026-15375 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-15375

Vulnerability Analysis

The vulnerability affects the users_ldap.jsp page within the Eleveo Call Recording Software web interface. This page is part of the LDAP User Interface, which manages Lightweight Directory Access Protocol (LDAP) user entries within the call recording platform. The application fails to enforce proper authorization checks before executing sensitive operations exposed by this endpoint. As a result, a user who has already authenticated with low-tier privileges can invoke functionality intended for higher-privileged administrators. The weakness is classified under [CWE-266] Incorrect Privilege Assignment, indicating that assigned privileges do not match the intended access model.

Root Cause

The root cause is missing or insufficient authorization validation inside the request handler backing /callrec/users_ldap.jsp. The application appears to rely on authentication as the sole gate, without verifying that the calling user holds the role required to access LDAP user management logic. This design gap allows privilege boundaries between standard operators and LDAP administrators to collapse.

Attack Vector

An attacker requires network access to the web interface and valid low-privilege credentials. After authenticating, the attacker issues HTTP requests directly to /callrec/users_ldap.jsp with parameters normally reserved for administrative workflows. The server processes these requests without enforcing role checks, granting access to LDAP-related functionality. No user interaction is required, and the attack complexity is low. Public proof-of-concept material has been published in a GitHub PoC Repository and referenced in the VulDB CVE Detail entry.

No verified exploit code is reproduced here. Refer to the referenced advisories for technical proof-of-concept details.

Detection Methods for CVE-2026-15375

Indicators of Compromise

HTTP requests to /callrec/users_ldap.jsp originating from user accounts that do not belong to LDAP or system administrator roles.
Unexpected LDAP user enumeration or configuration changes performed outside of scheduled administrative activity.
Authentication sessions issuing administrative parameters from IP ranges not associated with the administrator workstations.

Detection Strategies

Enable verbose web server access logging for the /callrec/ application and alert on any hit to users_ldap.jsp from non-administrative session identifiers.
Correlate application-layer role information with request paths to identify authorization mismatches on sensitive JSP endpoints.
Baseline normal administrative usage patterns for the LDAP User Interface and flag deviations in frequency, source, or timing.

Monitoring Recommendations

Forward Eleveo Call Recording application and web server logs to a centralized SIEM for long-term correlation and hunting.
Monitor LDAP directory changes downstream to detect unauthorized user modifications initiated from the recording platform.
Alert on repeated 200 OK responses to users_ldap.jsp from accounts that historically only access agent or supervisor pages.

How to Mitigate CVE-2026-15375

Immediate Actions Required

Restrict network access to the /callrec/ web interface to trusted management networks using firewall or reverse proxy rules.
Audit all Eleveo Call Recording user accounts and remove or downgrade unused low-privilege accounts that could be leveraged as a foothold.
Review recent activity against /callrec/users_ldap.jsp and investigate any access from non-administrative users.

Patch Information

As of the last modified date (2026-07-14), no vendor advisory or patch has been published. The vendor did not respond to disclosure attempts prior to public release. Organizations should track the VulDB Vulnerability #377442 entry and the GitHub CVE Repository for updates and any vendor-issued fixes.

Workarounds

Place /callrec/users_ldap.jsp behind a reverse proxy that enforces path-based access control restricted to administrator source IPs.
Disable or remove the LDAP User Interface JSP file if LDAP-based user management is not required in the deployment.
Enforce network segmentation so only administrator workstations can reach the Eleveo Call Recording management endpoints.

bash

# Example NGINX reverse proxy restriction for the vulnerable endpoint
location = /callrec/users_ldap.jsp {
    allow 10.10.20.0/24;   # admin subnet
    deny  all;
    proxy_pass http://callrec-backend;
}