This vulnerability in Eleveo Call Recording Software 9.7.0 allows an attacker to manipulate the callId parameter in the /callrec/audio.jsp endpoint, leading to improper authorization. This flaw could enable unauthorized access to call recordings or related functionality. The vulnerability is remotely exploitable without user interaction and requires low privileges. The vendor has not responded to disclosure and no official fix or mitigation guidance is available.

An attacker with network access can exploit this vulnerability to bypass authorization controls in the call recording handler, potentially gaining unauthorized access to call recordings or related sensitive data. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low impact on confidentiality. There is no indication of integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not provided a fix or responded to the disclosure, organizations should monitor for vendor updates. Until a patch is available, consider restricting network access to the affected endpoint and implementing compensating controls to limit unauthorized access to call recordings.