CVE-2026-15474: Eleveo Call Recording Auth Bypass Flaw

CVE-2026-15474 Overview

CVE-2026-15474 is an improper authorization vulnerability [CWE-266] in Eleveo Call Recording Software 9.7.0. The flaw resides in the /callrec/audio.jsp endpoint of the Call Recording Handler component. Attackers can manipulate the callId parameter to access recorded audio outside their authorization scope. The attack is executed remotely over the network and requires only low-privilege authentication.

A public exploit has been released, increasing the risk of opportunistic abuse. The vendor was contacted before public disclosure but did not respond, and no official patch is currently referenced in the advisory.

Critical Impact

Authenticated remote attackers can access call recordings belonging to other users by manipulating the callId parameter on /callrec/audio.jsp.

Affected Products

• Eleveo Call Recording Software 9.7.0
• Component: Call Recording Handler (/callrec/audio.jsp)
• Parameter: callId

Discovery Timeline

• 2026-07-12 - CVE-2026-15474 published to NVD
• 2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-15474

Vulnerability Analysis

The vulnerability is classified as improper authorization under [CWE-266]. The /callrec/audio.jsp handler accepts a callId argument that identifies the requested call recording. The application does not validate whether the authenticated user is authorized to access the recording associated with the supplied identifier.

An authenticated attacker with low privileges can iterate callId values and retrieve recordings belonging to other tenants or users. This exposes confidential voice data captured by the platform. The attack originates from the network and does not require user interaction.

The EPSS score is 0.207% with a percentile of 10.958, indicating low observed exploitation likelihood at time of publication. However, the exploit has been publicly released, which can change activity levels quickly.

Root Cause

The root cause is a missing authorization check on server-side handling of the callId request parameter. The application treats a valid session as sufficient to return the associated audio resource. It does not enforce an ownership or role-based access control decision that ties the requesting principal to the recording metadata.

Attack Vector

An attacker authenticates with any low-privilege account on the Eleveo instance. The attacker issues HTTP requests to /callrec/audio.jsp with modified callId values. The server returns audio content for identifiers the attacker does not own. Enumeration of sequential or guessable identifiers enables bulk retrieval of call recordings.

Technical details and proof-of-concept material are published on the GitHub CVE PoC Repository and referenced in VulDB Vulnerability Details.

Detection Methods for CVE-2026-15474

Indicators of Compromise

• HTTP requests to /callrec/audio.jsp from a single authenticated session with a high volume of distinct callId values.
• Sequential or enumerated callId values in access logs, indicating scripted retrieval.
• Access to callId values that do not correspond to the authenticated user's own call history.

Detection Strategies

• Correlate application session identity with the owner of each accessed callId and alert on mismatches.
• Baseline normal per-user audio retrieval rates and flag statistical outliers on /callrec/audio.jsp.
• Ingest Eleveo application logs into a SIEM and build rules for cross-user recording access patterns.

Monitoring Recommendations

• Enable verbose access logging on the Call Recording Handler and forward logs to centralized analytics.
• Monitor authentication events for accounts that access disproportionate numbers of recordings.
• Alert on any external IP addresses hitting /callrec/audio.jsp with automated request signatures.

How to Mitigate CVE-2026-15474

Immediate Actions Required

• Restrict network access to the Eleveo Call Recording Software management interface to trusted administrative networks only.
• Audit existing user accounts and disable or reset any non-essential low-privilege accounts that could be used for exploitation.
• Review historical logs for /callrec/audio.jsp requests to identify potential prior abuse.

Patch Information

No vendor patch is referenced in the advisory. The vendor did not respond to disclosure attempts per the VulDB CVE Overview. Organizations should track vendor communications for a future security update and apply it immediately upon release.

Workarounds

• Place the application behind a reverse proxy or web application firewall that enforces per-user authorization checks on callId values.
• Rotate credentials for all users of the Call Recording platform and enforce strong authentication controls.
• Consider isolating the Eleveo deployment on a segmented network until a vendor fix is available.

# Example WAF rule concept: block requests to audio.jsp from unauthenticated sources
# and rate-limit per-session access to distinct callId values.
location /callrec/audio.jsp {
    limit_req zone=callrec burst=5 nodelay;
    allow 10.0.0.0/8;
    deny all;
}