CVE-2026-101144 in Call Recording Software
Summary
by MITRE • 09/29/2026
A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/searchAction.do of the component Query Builder. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The Eleveo Call Recording Software version 9.7.0 contains a critical security flaw within its Query Builder component, specifically affecting the file /callrec/searchAction.do. This vulnerability stems from improper access controls that allow unauthorized users to manipulate query parameters or input data in ways intended for authenticated administrators or specific system roles. The core technical issue lies in the failure of the application server to properly validate user privileges before processing requests directed at this endpoint, effectively bypassing authentication and authorization mechanisms designed to restrict sensitive operations.
This flaw results in a classic Broken Access Control vulnerability, which is categorized under CWE-269 in the Common Weakness Enumeration standard. By exploiting this weakness, an attacker can perform actions such as viewing, modifying, or deleting call recordings and associated metadata without valid credentials. The impact of this misconfiguration extends beyond simple data leakage; it compromises the integrity and confidentiality of recorded communications, which are often subject to strict regulatory compliance requirements in industries like finance, healthcare, and legal services.
The vulnerability is remotely exploitable over a network connection, meaning that an attacker does not need physical access or prior authentication to initiate an attack. This characteristic significantly increases the risk profile as it allows for automated exploitation from remote locations across the internet. The fact that the exploit has been publicly disclosed further elevates the threat level, as malicious actors can leverage existing proof-of-concept code to compromise vulnerable systems with minimal effort and technical expertise required.
In terms of offensive security frameworks, this vulnerability aligns with MITRE ATT&CK techniques related to Unauthorized Access via Web Application Interfaces (T1078) and potentially Data Exfiltration over a Common Protocol if the attacker retrieves sensitive call data. The lack of response from the vendor since early contact indicates that no official patch or mitigation guidance has been provided, leaving organizations relying on this software in a state of prolonged exposure to active exploitation attempts.
To mitigate the risks associated with this vulnerability, immediate defensive measures must be implemented at the network and application layers. Organizations should restrict access to the /callrec/searchAction.do endpoint by implementing strict IP whitelisting or firewall rules that only allow traffic from trusted internal subnets if remote administrative access is not strictly required. Additionally, deploying a Web Application Firewall with specific rule sets designed to detect anomalous query parameter manipulation can help block exploitation attempts until an official patch becomes available.
Long-term remediation requires the organization to evaluate alternative call recording solutions or engage third-party security consultants to develop custom patches for the Eleveo software if supported by internal development resources. It is also critical to audit access logs and monitor for unusual patterns in query requests targeting this endpoint, as such activity may indicate ongoing exploitation attempts. Given the public disclosure of the exploit, proactive monitoring and immediate network-level restrictions are essential steps to protect sensitive communication data from unauthorized access.