The vulnerability CVE-2026-15376 affects Eleveo Call Recording Software version 9.7.0. It is caused by improper authorization in an unspecified function of the /callrec/statisticReportAction.do endpoint. This flaw allows remote attackers to bypass authorization controls, potentially accessing or manipulating restricted functionality. The exploit has been publicly disclosed, but the vendor has not provided any response or patch. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed.

Successful exploitation of this vulnerability could allow remote attackers to perform unauthorized actions within the affected software, potentially leading to unauthorized access or manipulation of call recording statistics or related data. The exact impact is not detailed due to the unspecified function affected, but improper authorization typically undermines access controls, increasing risk to confidentiality and integrity of data.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded and no temporary fixes are provided, users should apply compensating controls such as restricting network access to the affected endpoint and monitoring for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.