This vulnerability in Eleveo Call Recording Software 9.7.0 allows remote attackers to bypass proper authorization controls when interacting with the /callrec/restoreCallAction.do endpoint of the Recorded Calls Page component. The improper authorization flaw could enable unauthorized access or actions related to call recording restoration. The exploit is publicly available, but there is no indication of active exploitation in the wild. The vendor has not provided any response or patch, leaving the issue unmitigated officially.

An attacker with network access can remotely exploit this vulnerability to perform actions without proper authorization on the call recording restoration functionality. This could lead to unauthorized access or manipulation of recorded calls, potentially compromising sensitive call data or system integrity. The CVSS score of 5.3 reflects a medium impact with low complexity and no user interaction required.

No official patch or remediation is currently available from the vendor. Since the vendor has not responded to disclosure and no temporary fixes are documented, organizations should consider restricting network access to the affected endpoint and monitor for suspicious activity as interim measures. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.