Vulnerability · Published Sep 4, 2026 · Assigned by VulDB

CVE-2026-85408Eleveo Quality Management Conversation events dynamically-determined object attributes

Medium 4.3

In plain English

A medium-severity security flaw in Quality Management from Eleveo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 65.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in Eleveo Quality Management 9.7.0. Impacted is an unknown function of the file /enc-fwk-data/api/v3/conversations/<ID>/events of the component Conversation Handler. This manipulation of the argument createdBy causes dynamically-determined object attributes. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
Eleveo	Quality Management	9.7.0

Weakness: CWE-915, CWE-913 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

References

VDB-398558 | Eleveo Quality Management Conversation events dynamically-determined object attributes vdb-entry, technical-description
VDB-398558 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
CVE-2026-85408 | CVE Analysis and Report third-party-advisory
Submit #894906 | Eleveo Quality Management 9.7.0 Mass Assignment third-party-advisory
https://github.com/omarelshopky/cves/tree/main/eleveo/quality-management/CVE-2026-85408 exploit