CVE-2026-101144: Eleveo Call Recording Software Query Builder searchAction.do access control
A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/searchAction.do of the component Query Builder. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability is remotely exploitable and requires low-level privileges. No user interaction is required.
Which deployments are confirmed to be affected?
Eleveo Call Recording Software version 9.7.0 is identified as affected. The issue is associated with the Query Builder component and the /callrec/searchAction.do endpoint.
Is exploit activity a practical concern?
Yes. A public exploit disclosure exists and may be used, which increases the likelihood of attempted exploitation.
Is a vendor fix or mitigation available?
The available information does not identify a patch or workaround. It states that the vendor was contacted but did not respond.