CVE-2026-15374 describes an improper authorization vulnerability in Eleveo Call Recording Software 9.7.0 affecting an unspecified function in /callrec/roleAddAction.do of the Group Interface component. The vulnerability enables remote attackers to perform unauthorized actions by manipulating the affected function. The vendor has not issued a patch or provided remediation guidance, and the vulnerability is publicly disclosed with exploit code available. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to low impact on confidentiality, integrity, and availability.

Successful exploitation can lead to unauthorized access or actions within the Eleveo Call Recording Software, potentially compromising system integrity or confidentiality. The medium CVSS score reflects limited but meaningful impact due to improper authorization. There are no confirmed reports of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, organizations should consider implementing compensating controls such as restricting network access to the affected service and monitoring for suspicious activity related to /callrec/roleAddAction.do. Stay alert for any future vendor updates or patches.