CVE-2026-101144
Eleveo Call Recording Software Query Builder searchAction.do access control
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 28, 2026
- Updated
- Oct 20, 2026
- Reserved
- Sep 28, 2026
Description
A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/searchAction.do of the component Query Builder. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Call Recording SoftwareEleveo |
|
References
- VDB-410996 | Eleveo Call Recording Software Query Builder searchAction.do access controlvdb-entry
- VDB-410996 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-101144 | CVE Analysis and Reportthird-party-advisory
- Submit #894910 | Eleveo Call Recording 9.7.0 Business Logic Bypassthird-party-advisory
- https://github.com/omarelshopky/cves/tree/main/eleveo/call-recording-software/CVE-2026-101144exploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.