Eleveo Call Recording Software version 9.7.0 contains an improper access control vulnerability in the Query Builder component, located in the /callrec/searchAction.do endpoint. This flaw allows remote attackers to bypass intended access restrictions, potentially enabling unauthorized access to functionality or data. The vulnerability has been publicly disclosed, but the vendor has not provided any response or patch. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability.

The vulnerability allows remote attackers to bypass access controls in the affected software, potentially leading to unauthorized access to sensitive call recording data or query functionalities. The impact is limited to the extent of the access control bypass and the data or operations exposed by the vulnerable endpoint. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider restricting network access to the affected endpoint and monitor for suspicious activity as interim measures.