Vulnerability · Published Jul 10, 2026 · Assigned by VulDB
CVE-2026-15377Eleveo Call Recording Software sendlogfile improper authorization
Medium 4.3
In plain English
A medium-severity security flaw in Call Recording Software from Eleveo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities).
Official description
A vulnerability was determined in Eleveo Call Recording Software 9.7.0. Affected by this vulnerability is an unknown functionality of the file /callrec/sendlogfile. This manipulation causes improper authorization. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Eleveo | Call Recording Software | 9.7.0 |
Weakness: CWE-285, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
References
- VDB-377444 | Eleveo Call Recording Software sendlogfile improper authorization vdb-entry
- VDB-377444 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-15377 | CVE Analysis and Report third-party-advisory
- Submit #797462 | Eleveo Call Recording 9.7.0 Broken Access Control third-party-advisory
- https://github.com/omarelshopky/cves/tree/main/eleveo/call-recording-software/CVE-2026-15377 exploit