This vulnerability in Eleveo Call Recording Software 9.7.0 affects an unspecified function within the /callrec/roleAddAction.do file of the Group Interface component. The issue leads to improper authorization, enabling remote attackers to perform unauthorized actions by manipulating this function. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vendor was contacted but did not provide any response or patch. Exploit code is publicly available, increasing the risk of exploitation despite no known active attacks reported.

Successful exploitation allows remote attackers to bypass authorization controls in the affected component, potentially leading to unauthorized access or actions within the Eleveo Call Recording Software environment. The exact impact depends on the privileges granted by the vulnerable function but may include unauthorized role or permission changes. The medium CVSS score reflects a moderate risk due to ease of exploitation and potential impact on system security.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded and no fix is published, users should consider implementing compensating controls such as restricting network access to the affected interface, monitoring for suspicious activity related to /callrec/roleAddAction.do, and applying strict access controls where possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.