This vulnerability in Eleveo Call Recording Software 9.7.0 allows remote attackers to bypass proper authorization controls when interacting with the /callrec/restoreCallAction.do endpoint of the Recorded Calls Page component. The improper authorization flaw could permit unauthorized actions related to call recording restoration. Although an exploit is publicly available, there is no indication of widespread exploitation in the wild. The vendor has not provided a fix or advisory, leaving the vulnerability unmitigated officially.

Successful exploitation could allow an attacker with low privileges to perform unauthorized actions on the call recording restoration functionality, potentially leading to unauthorized access or manipulation of recorded calls. The CVSS 4.0 base score of 5.3 reflects a medium severity with network attack vector, low complexity, no user interaction, and limited confidentiality, integrity, and availability impacts.

No official patch or remediation is currently available from the vendor. Users should monitor vendor communications for updates. Until a fix is released, restricting network access to the affected endpoint and applying compensating controls such as strict access controls and monitoring may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.