| Title | Eleveo Quality Management 9.7.0 Denial of Service |
|---|
| Description | A Business Logic vulnerability exists in the /enc-fwk-data/api/v3/conversations/<ID>/events endpoint of Eleveo Quality Management 9.7.0 due to improper server-side validation of user-supplied input. The application fails to enforce validation on the labels parameter when processing tag creation requests, allowing authenticated users to submit empty or malformed values that are accepted and persisted by the backend. When the poisoned data is later retrieved and rendered, the frontend JavaScript fails to construct the DOM properly, resulting in a complete breakdown of the user interface and a blank screen. This condition affects any user who loads the impacted conversation, leading to a denial of service of the Conversations functionality.
Impact
• Denial of Service may occur when malformed data causes the frontend application to fail rendering, resulting in a white screen and preventing normal usage.
• Service disruption may occur when multiple users are affected by poisoned records appearing in shared views such as Conversations.
PoC
Comprehensive reproduction steps, including supporting screenshots, are available via the shared private link. Public disclosure will occur on GitHub after the responsible disclosure period of approximately 90 days has elapsed.
Note
Contact with the vendor was initiated on April 5, and no response has been received as of the submission date. The provided PoC is accessible via a restricted link and is intended solely for review purposes by anyone possessing the link. I plan to reserve a CVE early, with public disclosure scheduled after 90 days from the initial contact date, at which point the advisory will be published on my GitHub repository. The information shared here is provided exclusively to the VulnDB team to ensure awareness and understanding of the vulnerability details. |
|---|
| Source | ⚠️ https://drive.google.com/file/d/12yNkuZNJ79dpsKECbR_U7L4KCGRnYA8D/view?usp=sharing |
|---|
| User | omarelshopky (UID 85487) |
|---|
| Submission | 07/18/2026 14:47 (2 months ago) |
|---|
| Moderation | 09/03/2026 20:45 (2 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 398557 [Eleveo Quality Management 9.7.0 Conversation events labels denial of service] |
|---|
| Points | 20 |
|---|