CVE-2026-15373: Eleveo Call Recording Software userAddAction.do improper authorization

Published Jul 10, 2026

Updated

A vulnerability was detected in Eleveo Call Recording Software 9.7.0. The impacted element is an unknown function of the file /callrec/userAddAction.do. Performing a manipulation of the argument role results in improper authorization. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

1 affected component

Eleveo Call Recording Software=9.7.0

Event History

Jul 10, 2026

CVE Published

via MITRE·02:45 PM

Data Sourced

via MITRE·02:45 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-15373?

CVE-2026-15373 has a low severity score of 2.1.

How do I fix CVE-2026-15373?

To remediate CVE-2026-15373, ensure proper authorization checks are implemented for the /callrec/userAddAction.do function.

What kind of software is affected by CVE-2026-15373?

CVE-2026-15373 affects Eleveo Call Recording Software version 9.7.0.

Is CVE-2026-15373 exploitable remotely?

Yes, CVE-2026-15373 can be exploited remotely due to improper authorization.

What are the potential impacts of exploiting CVE-2026-15373?

Exploitation of CVE-2026-15373 may lead to unauthorized access and manipulation of user roles.