CVE-2026-15376: Eleveo Call Recording Auth Bypass Flaw

CVE-2026-15376 Overview

CVE-2026-15376 is an improper authorization vulnerability in Eleveo Call Recording Software version 9.7.0. The flaw resides in an unspecified function of the /callrec/statisticReportAction.do endpoint. An authenticated remote attacker with low privileges can manipulate the request to bypass authorization controls and access resources or actions outside their granted permissions. The weakness is classified under CWE-266: Incorrect Privilege Assignment. A public proof-of-concept has been released, increasing the likelihood of opportunistic exploitation. According to the disclosure, the vendor was contacted prior to publication but did not respond, so no coordinated patch timeline exists.

Critical Impact
Authenticated low-privilege users can abuse the statisticReportAction.do endpoint to bypass authorization checks, potentially exposing statistical reporting data and functionality intended for higher-privileged roles.

Affected Products

Eleveo Call Recording Software 9.7.0
Endpoint: /callrec/statisticReportAction.do
Vendor: Eleveo (no coordinated response received)

Discovery Timeline

2026-07-10 - CVE-2026-15376 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-15376

Vulnerability Analysis

The vulnerability affects the statistical reporting handler exposed at /callrec/statisticReportAction.do in Eleveo Call Recording Software 9.7.0. The action does not enforce authorization consistent with the caller's role. A user who holds valid but limited credentials can invoke the endpoint and obtain results that should be restricted to administrators or privileged reporting roles.

Call recording platforms handle sensitive data, including recorded conversations, call metadata, agent performance metrics, and customer identifiers. Improper authorization on reporting actions can therefore expose confidential business data and telephony records to users who should not see them. The published proof-of-concept demonstrates the request pattern needed to trigger the flaw against a running instance.

Root Cause

The root cause is a missing or incomplete authorization check on the statisticReportAction.do action handler. The application likely relies on authentication alone or on client-side role gating without validating that the authenticated principal is authorized to perform the specific server-side action. This matches the pattern described by [CWE-266], where a user is granted privileges beyond those required for their role.

Attack Vector

Exploitation is performed over the network against the web interface of the call recording server. The attacker must possess valid low-privilege credentials, but no user interaction and no elevated privileges are required beyond initial authentication. The exploit consists of issuing a crafted HTTP request to /callrec/statisticReportAction.do with parameters that trigger reporting functionality outside the attacker's authorization scope. A public proof-of-concept is available in the omarelshopky CVE-2026-15376 GitHub repository.

No verified code examples are published inline; refer to the VulDB Vulnerability Summary and the GitHub PoC Repository for reproduction details.

Detection Methods for CVE-2026-15376

Indicators of Compromise

HTTP requests to /callrec/statisticReportAction.do originating from user accounts that do not hold reporting or administrative roles.
Repeated parameter enumeration or fuzzing patterns targeting statisticReportAction.do, particularly from a single low-privileged session.
Unusual export or report generation activity outside normal business hours or from atypical source IP addresses.

Detection Strategies

Correlate authenticated web session identifiers with the role assigned in the Eleveo user database and alert when a non-privileged role accesses reporting endpoints.
Deploy web application firewall (WAF) rules that inspect requests to /callrec/* and match the requesting user's role against an allow-list per action.
Review Eleveo application and access logs for HTTP 200 responses to statisticReportAction.do where the session role should have received a 401 or 403.

Monitoring Recommendations

Enable verbose access logging on the Eleveo web tier and forward logs to a centralized SIEM for role-versus-endpoint correlation.
Alert on volume anomalies in report generation per user account, especially spikes from accounts with historically minimal reporting activity.
Track outbound data volume from the call recording server to detect bulk extraction of statistical or recording data.

How to Mitigate CVE-2026-15376

Immediate Actions Required

Restrict network access to the Eleveo Call Recording Software web interface using firewall or VPN controls so that only trusted administrative networks can reach /callrec/.
Audit all Eleveo user accounts and disable or downgrade any accounts that do not require access to statistical reporting functions.
Review recent access logs for the statisticReportAction.do endpoint and investigate any invocations from low-privileged accounts.

Patch Information

At the time of publication, the vendor Eleveo has not responded to the disclosure and no official patch or advisory has been released. Monitor the VulDB CVE Details page and the vendor's support channels for updates. Do not upgrade or downgrade without vendor confirmation that the specific authorization check on statisticReportAction.do has been remediated.

Workarounds

Place a reverse proxy or WAF in front of the Eleveo application and enforce role-based access control on requests to /callrec/statisticReportAction.do by validating the authenticated user's group membership before forwarding.
Implement network segmentation so the call recording server is only reachable by contact-center administrators and required integration services.
Rotate credentials for all low-privileged Eleveo accounts and enforce strong authentication to reduce the pool of accounts that could abuse the flaw.
Increase log retention for the Eleveo web tier so any post-disclosure exploitation attempts can be reconstructed and scoped.

bash

# Example nginx reverse proxy snippet to block low-privileged access
# to the vulnerable endpoint pending a vendor fix.
location = /callrec/statisticReportAction.do {
    # Allow only the administrative subnet
    allow 10.10.50.0/24;
    deny  all;
    proxy_pass http://eleveo-backend;
}