CVE-2026-85408: Dynamically-Determined Object Attributes in Eleveo Quality Management

CVE-2026-85408 is a vulnerability in Eleveo Quality Management 9.7.0 affecting an unknown function within the Conversation Handler component at the API endpoint /enc-fwk-data/api/v3/conversations/<ID>/events. The vulnerability arises from manipulation of the 'createdBy' argument, which causes dynamically-determined object attributes (CWE-913). The attack can be performed remotely without user interaction and requires low privileges. The vendor was contacted but did not provide a response or patch. Public exploit disclosure exists, but no known exploits in the wild have been reported.

The vulnerability allows an attacker with low privileges to remotely manipulate object attributes via the 'createdBy' argument, potentially leading to integrity impacts. There is no confidentiality or availability impact reported. The overall severity is low with a CVSS score of 4.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, monitor for updates from the vendor and consider restricting access to the affected API endpoint if possible.