CVE-2026-15472: Eleveo Call Recording Auth Bypass Flaw

CVE-2026-15472 Overview

CVE-2026-15472 is an improper authorization vulnerability in Eleveo Call Recording Software version 9.7.0. The flaw resides in unspecified code within the /callrec/composeEmailAction.do endpoint. An authenticated remote attacker with low privileges can manipulate requests to this endpoint to bypass authorization controls and perform actions beyond their assigned role. The weakness is classified under [CWE-266] Incorrect Privilege Assignment. According to VulDB, the vendor was contacted early about this disclosure but did not respond, and a proof-of-concept has been publicly released on GitHub.

Critical Impact
Authenticated remote attackers can abuse the composeEmailAction.do endpoint to perform unauthorized actions in Eleveo Call Recording Software 9.7.0, with a public proof-of-concept available and no vendor patch confirmed.

Affected Products

Eleveo Call Recording Software 9.7.0
Deployments exposing the /callrec/ web application to authenticated users
Environments where the vendor has not applied a mitigating configuration

Discovery Timeline

2026-07-12 - CVE-2026-15472 published to the National Vulnerability Database
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-15472

Vulnerability Analysis

The vulnerability is an improper authorization weakness affecting the /callrec/composeEmailAction.do action handler in Eleveo Call Recording Software 9.7.0. The application does not correctly enforce role or permission checks before executing the logic tied to this endpoint. As a result, a low-privileged authenticated user can issue a crafted request and invoke functionality that should be restricted to higher-privileged accounts. The issue is classified under [CWE-266] Incorrect Privilege Assignment and is exploitable over the network without user interaction.

Because composeEmailAction.do is associated with email composition workflows in the call recording application, unauthorized invocation could allow an attacker to trigger email-related operations using another user's authorization context. This can facilitate information disclosure or misuse of internal messaging features within the recording platform.

Root Cause

The root cause is missing or insufficient server-side authorization enforcement on the composeEmailAction.do Struts action. Authentication is required, but the application relies on client-side or role assumptions rather than verifying that the requesting principal has permission to execute the underlying business function.

Attack Vector

Exploitation requires network access to the /callrec/ web application and a valid low-privileged account. The attacker sends a crafted HTTP request to /callrec/composeEmailAction.do with parameters that invoke privileged behavior. No user interaction is required, and the exploit has been publicly disclosed in a GitHub proof-of-concept repository maintained by the reporter.

A verified exploit is available in the GitHub PoC Repository. Additional technical context is published in the VulDB Vulnerability Details entry.

Detection Methods for CVE-2026-15472

Indicators of Compromise

HTTP requests to /callrec/composeEmailAction.do originating from user accounts that lack the corresponding email or administrative role.
Unusual volumes of composeEmailAction.do invocations from a single session or IP address.
Application logs showing successful email compose actions correlated with low-privilege session identifiers.

Detection Strategies

Enable verbose access logging on the /callrec/ web application and correlate action URIs with the authenticated user's role.
Alert on any request to composeEmailAction.do where the associated session role does not include email or supervisor privileges.
Review web server and reverse proxy logs for repeated POST requests to Struts action endpoints under /callrec/.

Monitoring Recommendations

Baseline normal usage of the Eleveo call recording web interface per role and flag deviations.
Forward web application and authentication logs to a centralized log platform for cross-user correlation.
Monitor egress mail traffic from the Eleveo server for unexpected outbound messages generated by the application.

How to Mitigate CVE-2026-15472

Immediate Actions Required

Restrict network access to the /callrec/ application to trusted management networks or VPN users only.
Audit all user accounts and remove or disable unused low-privileged accounts that could be leveraged for exploitation.
Review web server logs for prior access to composeEmailAction.do by accounts without email privileges.
Contact Eleveo support directly to request a fixed build or vendor-supplied guidance, given no public advisory has been issued.

Patch Information

No vendor patch has been published at the time of writing. VulDB notes that the vendor was contacted early about this disclosure but did not respond. Administrators should track the VulDB CVE Record for updates and apply any future Eleveo release addressing the composeEmailAction.do authorization logic.

Workarounds

Deploy a web application firewall rule that blocks or limits requests to /callrec/composeEmailAction.do based on the authenticated user's role attribute.
Enforce network segmentation so the call recording server is not reachable from general user subnets.
Rotate credentials for any low-privileged accounts that may have been exposed, and enforce strong password and MFA policies on the application's authentication front end.

bash

# Example NGINX reverse proxy restriction limiting composeEmailAction.do to a trusted subnet
location = /callrec/composeEmailAction.do {
    allow 10.10.20.0/24;   # trusted admin subnet
    deny all;
    proxy_pass http://eleveo-backend;
}