This vulnerability in Eleveo Call Recording Software 9.7.0 involves improper authorization due to manipulation of the 'role' parameter in the /callrec/userAddAction.do function. An attacker can remotely exploit this flaw without user interaction or elevated privileges to perform unauthorized actions. The vendor has not provided a patch or remediation guidance, and the exploit details are publicly available.

Successful exploitation allows an attacker to bypass authorization controls related to user role assignment or modification, potentially enabling unauthorized access or privilege escalation within the affected software. This could compromise the integrity of call recording management functions.

No official patch or remediation is currently available from the vendor. Users should monitor vendor communications for updates. Until a fix is released, consider restricting network access to the affected endpoint and applying compensating controls to limit exposure.