CVE-2026-15473: Eleveo Call Recording Auth Bypass Flaw

CVE-2026-15473 Overview

CVE-2026-15473 is an improper authorization vulnerability [CWE-266] affecting Eleveo Call Recording Software version 9.7.0. The flaw resides in the /callrec/restoreCallAction.do endpoint of the Recorded Calls Page component. An authenticated remote attacker with low privileges can manipulate this endpoint to perform actions outside their authorized scope. Public proof-of-concept code exists, raising the likelihood of opportunistic exploitation attempts. The vendor was contacted but did not respond to disclosure outreach, meaning no official patch or advisory has been published.

Critical Impact

Authenticated remote attackers can bypass authorization controls on the Recorded Calls Page and interact with call recording data or actions they should not be permitted to access.

Affected Products

• Eleveo Call Recording Software 9.7.0
• Component: Recorded Calls Page (/callrec/restoreCallAction.do)
• Deployments exposing the callrec web interface to authenticated users

Discovery Timeline

• 2026-07-12 - CVE-2026-15473 published to NVD
• 2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-15473

Vulnerability Analysis

The vulnerability affects the restoreCallAction.do handler in the /callrec/ web application path. This endpoint governs restore operations against recorded call data. The handler fails to enforce proper authorization checks before processing the requested action. An attacker with valid low-privilege credentials can craft requests that operate on resources or actions belonging to other users or higher privilege levels.

CWE-266 (Incorrect Privilege Assignment) describes conditions where a user is granted rights beyond what the application security policy intends. In this case, the application accepts a request, verifies the session token, but does not verify whether the authenticated principal is entitled to perform the requested restore operation. The attack surface is exposed over the network and requires no user interaction to trigger.

Root Cause

The root cause is missing or insufficient authorization logic in the restoreCallAction.do request handler. The application performs authentication checks but omits object-level or function-level authorization validation before executing the restore action.

Attack Vector

Exploitation occurs remotely over the network. The attacker requires a valid low-privilege account on the target instance. Once authenticated, the attacker issues HTTP requests to /callrec/restoreCallAction.do with parameters targeting resources outside their authorization boundary. A public proof-of-concept is published in the GitHub PoC Repository. Additional technical context is available at the VulDB CVE Entry.

No verified exploit code is reproduced here. Refer to the linked references for technical proof-of-concept details.

Detection Methods for CVE-2026-15473

Indicators of Compromise

• HTTP requests to /callrec/restoreCallAction.do originating from low-privilege user sessions
• Restore actions executed against call recordings not owned by the requesting user
• Repeated restoreCallAction.do invocations with iterated identifiers, suggesting enumeration
• Access log entries showing successful restore responses for accounts without administrative roles

Detection Strategies

• Baseline normal usage of the restoreCallAction.do endpoint per user role and alert on deviations
• Correlate authenticated user identity against the ownership of the target call record referenced in the request
• Deploy web application firewall rules that log and inspect all POST and GET traffic to /callrec/ administrative actions
• Review authentication logs for accounts that suddenly begin issuing restore operations after periods of inactivity

Monitoring Recommendations

• Forward Eleveo Call Recording application and web server logs to a centralized logging platform for retention and analysis
• Enable audit logging on the callrec application for all state-changing actions including restore, delete, and export
• Monitor outbound egress from the Eleveo host for unexpected data transfers following restore events
• Alert on any modification to authorization configuration files on the application server

How to Mitigate CVE-2026-15473

Immediate Actions Required

• Restrict network access to the /callrec/ interface using firewall rules or reverse proxy allowlists
• Audit all user accounts and remove or disable any that do not require access to call recording functions
• Enforce least-privilege role assignments and review who currently holds restore permissions
• Enable verbose access logging on the restoreCallAction.do endpoint pending an official fix

Patch Information

No vendor patch is currently available. According to the disclosure record, the vendor was contacted about this issue but did not respond. Monitor the VulDB Vulnerability Details page for updates and consult Eleveo directly for remediation guidance.

Workarounds

• Place the Eleveo Call Recording application behind an authenticating reverse proxy that enforces additional role-based access controls
• Block direct external access to /callrec/restoreCallAction.do and permit access only from trusted administrative networks
• Rotate credentials for all low-privilege accounts and enforce multi-factor authentication where supported
• Consider disabling the restore functionality at the web server layer until authorization enforcement can be validated

# Example nginx configuration restricting access to the vulnerable endpoint
location = /callrec/restoreCallAction.do {
    allow 10.0.0.0/8;      # trusted admin network
    deny  all;
    proxy_pass http://eleveo-backend;
}