Eleveo Call Recording Software version 9.7.0 contains an improper authorization vulnerability in an unknown function of the /callrec/sendlogfile endpoint. This flaw allows remote attackers to perform unauthorized actions due to insufficient access controls. The vulnerability has been publicly disclosed, but the vendor has not issued a fix or provided guidance. The CVSS 4.0 base score is 5.3, indicating medium severity, with network attack vector, low complexity, no privileges required, and no user interaction needed.

An attacker can remotely exploit this vulnerability to bypass authorization controls in the affected software. This could lead to unauthorized access or manipulation of call recording data or related functionality. The exact impact is not detailed, but improper authorization typically risks data confidentiality and integrity.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded to the disclosure, users should apply compensating controls such as restricting network access to the affected endpoint and monitoring for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.