Eleveo Call Recording Software 9.7.0 contains an improper authorization vulnerability in the /callrec/composeEmailAction.do file. This flaw allows remote attackers to perform unauthorized actions by manipulating the affected component. The vulnerability has been publicly disclosed, but the vendor has not provided any response or remediation. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, no privileges required, and no user interaction needed.

Successful exploitation of this vulnerability could allow remote attackers to bypass authorization controls and perform actions that should be restricted, potentially leading to unauthorized access or manipulation within the Eleveo Call Recording Software environment. The exact impact depends on the privileges gained through the improper authorization but is limited to the scope of the affected component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor for official updates. Until a patch is available, consider restricting network access to the affected component and applying compensating controls to limit exposure.