CVE-2026-15377: Eleveo Call Recording Auth Bypass Flaw

CVE-2026-15377 Overview

CVE-2026-15377 is an improper authorization vulnerability [CWE-266] in Eleveo Call Recording Software version 9.7.0. The flaw resides in an unspecified function of the /callrec/sendlogfile endpoint. An authenticated remote attacker with low privileges can manipulate the endpoint to bypass authorization controls. The exploit has been publicly disclosed, increasing the risk of opportunistic abuse. According to the vulnerability record, the vendor was contacted about this issue but did not respond.

Critical Impact
Authenticated remote attackers can abuse the /callrec/sendlogfile endpoint to access functionality outside their authorization boundary, potentially exposing log file data from the call recording platform.

Affected Products

Eleveo Call Recording Software 9.7.0
Endpoint: /callrec/sendlogfile
Vendor status: Unresponsive to disclosure

Discovery Timeline

2026-07-10 - CVE-2026-15377 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-15377

Vulnerability Analysis

The vulnerability affects the /callrec/sendlogfile endpoint of Eleveo Call Recording Software 9.7.0. The endpoint fails to enforce proper authorization checks against the authenticated caller. As a result, a low-privileged user can invoke functionality that should be restricted to higher-privileged roles. The weakness is categorized as [CWE-266] Incorrect Privilege Assignment. Because the flaw is reachable over the network with only low privileges required, exploitation does not depend on user interaction. Public disclosure of a proof of concept increases the likelihood of scripted probing against exposed installations.

Root Cause

The root cause is missing or incomplete authorization enforcement on the /callrec/sendlogfile handler. The application authenticates the requester but does not correctly validate whether that identity is permitted to trigger the log file operation. Trust is placed in the session or role state without a server-side check tied to the requested action.

Attack Vector

An attacker authenticates to the Eleveo Call Recording web interface with any valid low-privilege account. The attacker then issues a crafted HTTP request to /callrec/sendlogfile. The server processes the request without a sufficient authorization check and performs the log file operation. Public proof-of-concept material is available in the GitHub PoC Repository.

// No verified exploitation code is published in the CVE record.
// Refer to the linked PoC repository for technical reproduction steps.

Detection Methods for CVE-2026-15377

Indicators of Compromise

Unexpected HTTP requests to the /callrec/sendlogfile path originating from non-administrative user sessions.
Log file transfers or downloads initiated outside of scheduled maintenance windows.
Repeated authenticated requests to the endpoint from a single low-privileged account within a short interval.

Detection Strategies

Enable verbose access logging on the Eleveo web tier and alert on any access to /callrec/sendlogfile by accounts not in an administrator role.
Baseline normal usage of the endpoint and flag deviations in request volume, source IP, or user-agent.
Correlate authentication events with subsequent sendlogfile requests to detect privilege boundary crossings.

Monitoring Recommendations

Forward web server and application logs from the Eleveo host to a centralized log platform for retention and analysis.
Track outbound transfers of log artifacts from the Eleveo server to identify unauthorized exfiltration.
Review role-to-endpoint mappings periodically to confirm least-privilege enforcement.

How to Mitigate CVE-2026-15377

Immediate Actions Required

Restrict network access to the Eleveo Call Recording management interface to trusted administrative networks only.
Audit all user accounts on the Eleveo platform and disable or downgrade unused low-privileged accounts.
Rotate credentials for accounts that have access to the affected version to limit reuse of any exposed sessions.
Monitor the VulDB CVE Details page for updated vendor guidance.

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2026-15377. The disclosure record notes that the vendor did not respond to outreach. Operators should track vendor communications directly and apply any future updates from Eleveo as they become available.

Workarounds

Place the Eleveo Call Recording interface behind a reverse proxy or VPN that enforces additional access control lists on /callrec/sendlogfile.
Use web application firewall rules to block or challenge requests to /callrec/sendlogfile from users not assigned administrative roles.
Segment the Eleveo server from general user networks so only authorized management workstations can reach the web interface.

bash

# Example nginx snippet to restrict the vulnerable endpoint by source IP
location = /callrec/sendlogfile {
    allow 10.10.20.0/24;   # admin management subnet
    deny  all;
    proxy_pass http://eleveo_backend;
}