CVE-2026-15471: Eleveo Call Recording Auth Bypass Flaw

CVE-2026-15471 Overview

CVE-2026-15471 is an improper authorization vulnerability in Eleveo Call Recording Software version 9.7.0. The flaw resides in the /callrec/pci_dss_status.jsp endpoint, which fails to enforce proper authorization checks on incoming requests. An authenticated remote attacker with low privileges can manipulate requests to this endpoint to access functionality or data outside their permitted scope. The exploit has been publicly disclosed, and the vendor did not respond to disclosure attempts. This vulnerability is classified under [CWE-266: Incorrect Privilege Assignment].

Critical Impact
Remote authenticated attackers can bypass authorization controls on the PCI DSS status interface, potentially exposing compliance-related data without proper privilege verification.

Affected Products

Eleveo Call Recording Software 9.7.0
Component: /callrec/pci_dss_status.jsp
Deployments exposing the callrec web application to remote users

Discovery Timeline

2026-07-12 - CVE-2026-15471 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-15471

Vulnerability Analysis

The vulnerability affects the pci_dss_status.jsp component of the Eleveo Call Recording Software callrec web application. The endpoint processes requests without verifying that the requesting user holds the appropriate role or privilege level to access the PCI DSS status information. As a result, a low-privileged authenticated user can manipulate the request and reach functionality intended for administrative or compliance roles.

The flaw is remotely exploitable over the network and requires low-level authentication. A public proof-of-concept exists in an external GitHub repository, and details are cataloged in the VulDB CVE Record. The vendor was contacted before public disclosure but did not respond. The EPSS score is 0.207% with a percentile of 10.9, indicating a currently low predicted probability of exploitation activity.

Root Cause

The root cause is missing or insufficient authorization logic within pci_dss_status.jsp. The JSP page processes requests based on authentication status alone without validating whether the authenticated identity has been granted the specific role required to view PCI DSS compliance information. This aligns with [CWE-266], where privileges assigned to a user or component exceed what is necessary or intended.

Attack Vector

An attacker with valid low-privilege credentials sends a crafted HTTP request to /callrec/pci_dss_status.jsp over the network. Because the endpoint does not verify role-based access, the server returns data or exposes functionality that should be restricted. No user interaction is required, and the attack complexity is low. Refer to the VulDB Vulnerability Overview for additional technical context.

Detection Methods for CVE-2026-15471

Indicators of Compromise

HTTP requests to /callrec/pci_dss_status.jsp originating from user accounts that are not part of administrative or compliance groups.
Unusual response sizes or successful (HTTP 200) responses to pci_dss_status.jsp from low-privilege session tokens.
Repeated access attempts to callrec endpoints from a single low-privileged user in short time windows.

Detection Strategies

Correlate web server access logs with identity role assignments to flag pci_dss_status.jsp requests from users lacking compliance roles.
Deploy web application firewall (WAF) rules that inspect access to /callrec/pci_dss_status.jsp and validate role claims in session cookies or headers.
Baseline expected access patterns for the callrec application and alert on deviations involving compliance-related endpoints.

Monitoring Recommendations

Enable verbose HTTP access logging on the Eleveo Call Recording server, capturing user identity, source IP, and request path.
Forward logs to a centralized SIEM or data lake for cross-user behavioral analysis on callrec endpoints.
Review authentication and authorization logs weekly for anomalous access to PCI DSS status resources.

How to Mitigate CVE-2026-15471

Immediate Actions Required

Restrict network access to the /callrec/ application path so that only trusted management networks can reach pci_dss_status.jsp.
Audit accounts with access to the Eleveo Call Recording Software and remove or downgrade unnecessary user privileges.
Monitor the VulDB CVE Record for updates and any future vendor advisories.

Patch Information

The vendor did not respond to the disclosure and has not published a patch or advisory at the time of writing. Organizations running Eleveo Call Recording Software 9.7.0 should contact Eleveo directly for remediation guidance and track the VulDB Submission Entry for status changes.

Workarounds

Place the callrec web application behind a reverse proxy that enforces role-based access control on pci_dss_status.jsp before requests reach the JSP handler.
Apply WAF rules that block requests to /callrec/pci_dss_status.jsp unless the session belongs to an authorized compliance or administrator role.
Segment the recording server on a management VLAN with firewall access lists limiting who can reach the web interface.

bash

# Example nginx reverse proxy rule restricting access to pci_dss_status.jsp
location = /callrec/pci_dss_status.jsp {
    allow 10.10.20.0/24;   # compliance admin subnet
    deny  all;
    proxy_pass http://callrec-backend;
}