CVE-2026-85408: Dynamically-Determined Object Attributes in Eleveo Quality Management

This vulnerability affects Eleveo Quality Management 9.7.0 in the Conversation Handler component. Specifically, the API endpoint /enc-fwk-data/api/v3/conversations/<ID>/events improperly handles the 'createdBy' argument, leading to dynamically-determined object attributes. This flaw can be exploited remotely with low complexity and no user interaction, potentially allowing an attacker with low privileges to manipulate object attributes dynamically. The vendor was notified but did not provide a response or patch. Public exploit information is available, but no active exploitation has been confirmed.

An attacker with low privileges can remotely exploit this vulnerability to manipulate object attributes dynamically via the 'createdBy' argument in the Conversation Handler API. This could lead to unauthorized behavior or data manipulation within the affected component. The exact impact beyond this is not detailed in the available information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should monitor for official updates from Eleveo. Until a fix is released, consider restricting access to the affected API endpoint and limiting privileges to reduce exposure.