This vulnerability in Eleveo Call Recording Software 9.7.0 arises from improper authorization checks in an unspecified function within the /callrec/userAddAction.do file. Manipulating the 'role' argument allows an attacker with low privileges to perform unauthorized actions remotely. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. The vendor has not issued any patch or advisory, and no official remediation is currently available. Exploit code is publicly accessible, increasing the risk of exploitation.

An attacker with low privileges can remotely manipulate the 'role' parameter to bypass authorization controls, potentially gaining unauthorized access or performing unauthorized actions within the Eleveo Call Recording Software 9.7.0 environment. This could lead to privilege escalation or unauthorized user management, impacting confidentiality and integrity of the system.

No official fix or patch is currently available from the vendor. Since the vendor has not responded and no remediation level is provided, users should consider implementing compensating controls such as restricting network access to the affected endpoint, monitoring for suspicious activity related to user role changes, and applying strict access controls until a vendor patch or official guidance is released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.