Eleveo Call Recording Software Insecure Direct Object Reference Vulnerability

Vulnerability Overview Eleveo Call Recording Software version 9.7.0 contains multiple access control vulnerabilities that allow low-privilege authenticated users to bypass administrator-defined filters. By utilizing the and endpoints, these users can retrieve restricted call details. Although administrators can configure filters to limit the call records accessible to users, the backend fails to correctly enforce these restrictions when processing email sending requests. By manipulating these endpoints, users can retrieve call information that should be inaccessible and send call details along with audio attachments to arbitrary email addresses. Impact Scope Exposure of Restricted Call Records: Allows users to bypass administrator-defined filters to access call details that should be unavailable. Unauthorized Distribution: Users can distribute call records, including audio attachments, to arbitrary email addresses without authorization by sending the retrieved data. Remediation 1. Backend Validation: Ensure that the backend correctly enforces administrator-defined filter restrictions when processing email sending requests. 2. Permission Checks: Add permission checks to the and endpoints to ensure that only users with appropriate permissions can access restricted call records. 3. Log Monitoring: Enhance log monitoring for anomalous access behavior to promptly detect and respond to potential security incidents. POC Code Timeline October 3, 2026: Initial contact with the vendor. January 4, 2026: Second attempt to contact the vendor, no response received. May 4, 2026: Vulnerability submitted to VulDB to obtain a CVE identifier. November 7, 2026: CVE assigned and published. Software Details Vendor Name: Eleveo Software Name: Call Recording Software Software URL: https://www.eleveo.com/call-recording-software Affected Version: 9.7.0 Vulnerability Type Broken Access Control / Improper Authorization Reproduction Steps 1. Log in as an administrator user and navigate to Users. 2. Create a filter for the target user that hides all call records. For example, set a date range during which no calls were recorded. 3. Log in as the restricted user and navigate to Recorded Calls. Observe that no call records are returned, and the title indicates limited access. 4. Extract the token from the HTML elements. 5. Navigate to . 6. Using Burp Suite, change the request method to POST and set the request body as follows. Ensure the parameter corresponds to the Call ID you wish to access. Note that Call IDs are incremental. 7. The email composition screen will open, displaying the start date, caller, call number, and attached media files. Enter a controlled email address and click Send. 8. Observe that a request is triggered to , and the UI indicates the email was sent successfully. 9. Check the inbox to confirm that call information and recordings were sent, despite the user not having permission to access the recordings.

Goal Reached Thanks to every supporter — we hit 100%!

Eleveo Call Recording Software Insecure Direct Object Reference Vulnerability

More from this source