CVE-2026-101143

Executive Summary

CVE-2026-101143 is an information disclosure vulnerability in Eleveo Quality Management 9.7.0, affecting an unidentified function within the /qm/cz.zoom.scorecard.webui.Scorecard/cz.zoom.scorecard.webui.Scorecard/QMBODownload endpoint. The flaw can be triggered remotely by a low-privileged authenticated user and allows unauthorized access to data that should not be exposed. The vendor was contacted early during coordinated disclosure but did not respond, and public exploit details are reportedly available, meaning no official fix currently exists.

Technical Analysis

Eleveo Quality Management is a workforce optimization and quality monitoring platform commonly deployed in contact-center environments, where it captures and stores call recordings, screen recordings, scoring data, agent performance metrics, and potentially sensitive customer interaction content. The vulnerable component is reached through the path /qm/cz.zoom.scorecard.webui.Scorecard/cz.zoom.scorecard.webui.Scorecard/QMBODownload, which indicates a request handler on a backend service (the QMBODownload endpoint) exposed under the Zoom-integration scorecard web UI module.

The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The NVD description states that "the manipulation results in information disclosure" via "some unknown functionality" of the referenced file/endpoint. Because the exact function, parameter, and access-control logic are not disclosed, the mechanism must be described at the vulnerability-class level: this is an access-control / information-exposure defect in which the QMBODownload handler returns data (for example, a report or file object) to a requester who should not be authorized to receive it. Two common mechanisms fit the observed CVSS profile:

1. Missing or insufficient authorization check — the endpoint processes a download request without validating that the requesting principal owns or is permitted to view the referenced object (an IDOR-style exposure), or without validating it at all beyond authentication.
2. Missing/improper access control on a download action — the handler serves a resource directly rather than enforcing the same object-level authorization applied elsewhere in the application.

The CVSS v3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N quantifies the observable properties precisely. Network exploitable (AV:N), low attack complexity (AC:L), requires low privileges (PR:L, i.e., any authenticated low-privilege account), no user interaction (UI:N), scope unchanged (S:U), and impact confidentiality only with a Low rating (C:L), and no integrity or availability impact (I:N/A:N). The Low confidentiality rating (CVSS 4.3) indicates that the exposure is limited — not the entire data store — but still represents a real leak of information an attacker is not entitled to. Critically, PR:L means an attacker does not need administrative access; a single valid low-privilege account on the platform is sufficient to reach the vulnerable endpoint. There is no evidence in the provided data of any code-execution, write, or denial-of-service component.

Exploitation Scenarios

No public PoC code is present in the supplied data set (PoC_STATUS reflects that exploit details were "made public" per the NVD description, but no exploit artifact, Nuclei template, or exploit code is included here). The following attack chain is therefore described at the vulnerability-class level and is inferred from the vulnerability class (CWE-200, access-control exposure), not from a reviewed exploit.

1. Reconnaissance / target identification. An attacker identifies an internet- or intranet-reachable Eleveo Quality Management 9.7.0 deployment. Fingerprinting can be performed via HTTP title/content matching (see SHODAN_DORKS) for the Zoom scorecard UI and the QMBODownload path. Because the endpoint is under /qm/, the target is the quality-management web application tier.

2. Authentication to satisfy PR:L. The CVSS dependence on low privileges implies the attacker needs at least one valid low-privilege account. This may be obtained through credential reuse, a previously compromised agent/analyst account, or social engineering of a contact-center user. Because UI:N, no victim action is needed once credentials exist.

3. Triggering the information-disclosure condition. The attacker sends a crafted request to the /qm/cz.zoom.scorecard.webui.Scorecard/cz.zoom.scorecard.webui.Scorecard/QMBODownload endpoint. Per the NVD description, "manipulation" of the request handling results in disclosure — i.e., the attacker manipulates request inputs (an object identifier, scorecard reference, or similar parameter) so that the handler returns data belonging to another user, another team, or data otherwise withheld. No specific parameter names are disclosed in the advisory and none are invented here. The core failure is that the handler does not sufficiently authorize the caller against the requested object before returning it.

4. Post-exploitation impact. The attacker obtains the disclosed content. Given the product domain, exposed data is likely to include scorecard/report content and associated quality-management records. The CVSS C:L indicates a bounded confidentiality loss rather than bulk extraction of all stored data. There is no integrity or availability effect, so the attacker cannot modify or destroy data through this vector. The practical value is intelligence gathering and lateral targeting (e.g., using leaked operational data to refine further attacks or to satisfy espionage objectives).

Because the vendor did not respond and no patch exists, this exposure remains reachable on any unmitigated 9.7.0 instance that is network-exposed and has an accessible low-privileged account.

Impact Assessment

Business impact. Eleveo Quality Management sits in contact-center operations, a domain that routinely processes customer PII and call content. An information-disclosure defect in the scorecard/download path can expose internal quality reports and related records to a user who should not see them. In regulated environments (finance, healthcare, telecom, BPO), any unauthorized disclosure of customer-linked interaction data can trigger privacy-notification obligations under regimes such as GDPR, HIPAA, or PCI-DSS, even when the technical severity is modest.

Affected systems / blast radius. Confirmed affected: Eleveo Quality Management 9.7.0. The CVSS profile (AV:N, PR:L) means the blast radius is bounded by (a) network reachability of the /qm/ web tier and (b) possession of any valid low-privilege credential. Scope is unchanged (S:U), so the flaw does not, per the vector, allow the attacker to pivot beyond the security authority of the vulnerable component — but the confidentiality leak within that boundary is real and repeatable.

Subscore interpretation.

• AV:N — exploitable across the network, no local access required.
• AC:L — no special conditions or race windows; straightforward request crafting.
• PR:L — any authenticated low-privilege account suffices; reduces barrier to entry.
• UI:N — no victim interaction needed; enables automated or scripted access.
• S:U — impact stays within the vulnerable component's authority.
• C:L — limited confidentiality impact; some sensitive data exposed, not total.
• I:N / A:N — no corruption or availability loss.

Aggregate risk. CVSS 4.3 (Medium). The score understates operational risk in two ways: the vulnerability is UNPATCHED with no vendor response, and exploit details were publicly released. EPSS is not yet available, so no exploitation-probability figure can be cited. No CISA KEV listing exists at time of writing.

Detection Guidance

The detection artifacts below target the specific, disclosed request path /qm/cz.zoom.scorecard.webui.Scorecard/cz.zoom.scorecard.webui.Scorecard/QMBODownload and the surrounding behavioral pattern (low-privilege users requesting download objects). Where a rule cannot reference a specific input parameter (none are disclosed), it keys on the endpoint itself, anomalous request frequency, and download volume rather than fabricating parameter names.

Sigma Rule

title: Eleveo Quality Management QMBODownload Information Disclosure Attempt
id: 8f4c1a2e-3b7d-4e91-9c2a-6d5f0a1b7c33
status: experimental
description: Detects access to the Eleveo QM scorecard QMBODownload endpoint associated with CVE-2026-101143 information disclosure.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101143
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: generic
detection:
  selection_path:
    cs-uri-stem|contains: '/QM_/QMBODownload'
  selection_full:
    cs-uri-stem|contains: 'cz.zoom.scorecard.webui.Scorecard/QMBODownload'
  selection_method:
    cs-method: 'GET'
  condition: (selection_path or selection_full) and selection_method
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate scheduled report downloads by authorized power users
level: medium
tags:
  - attack.t1190
  - cve.2026-101143

YARA Rule

rule CVE_2026_101143_Eleveo_QMBODownload_Probe
{
    meta:
        description = "Detects request strings targeting the Eleveo QM scorecard QMBODownload endpoint (CVE-2026-101143)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-101143"
        date = "2026-01-01"

    strings:
        $p1 = "cz.zoom.scorecard.webui.Scorecard" ascii nocase
        $p2 = "QMBODownload" ascii nocase
        $p3 = "/qm/" ascii nocase
        $hdr = "HTTP/" ascii

    condition:
        $hdr and $p2 and ($p1 or $p3)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-101143 Eleveo QM QMBODownload Information Disclosure Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"cz.zoom.scorecard.webui.Scorecard/QMBODownload"; nocase; http.uri; content:"/qm/"; nocase; classtype:attempted-recon; reference:cve,2026-101143; sid:2026101143; rev:1; metadata:affected_product Eleveo_Quality_Management, attack_target Web_Server, deployment Perimeter, signature_severity Minor, created_at 2026_01_01;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where url.path : "*/cz.zoom.scorecard.webui.Scorecard/QMBODownload*" and http.request.method : "GET"]
  [network where url.path : "*/cz.zoom.scorecard.webui.Scorecard/QMBODownload*" and http.response.status_code == 200]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=*access*
| search uri_path="*cz.zoom.scorecard.webui.Scorecard/QMBODownload*" OR uri_path="*/qm/*QMBODownload*"
| stats count values(status) as status_codes values(user) as users dc(clientip) as src_ips by uri_path user
| where count > 5
| table user uri_path count src_ips status_codes
| sort - count

Wazuh OSSEC Rule

<group name="web,eleveo,cve-2026-101143,">
  <rule id="1011430" level="5">
    <if_sid>31100</if_sid>
    <url>cz.zoom.scorecard.webui.Scorecard/QMBODownload</url>
    <description>CVE-2026-101143: Eleveo QM QMBODownload information disclosure request observed from $(srcip)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>access_control,</group>
  </rule>

  <rule id="1011431" level="10">
    <if_sid>1011430</if_sid>
    <url>cz.zoom.scorecard.webui.Scorecard/QMBODownload</url>
    <same_source_ip />
    <frequency>10</frequency>
    <timeframe>60</timeframe>
    <description>CVE-2026-101143: Repeated QMBODownload access (possible automated data harvesting) from $(srcip)</description>
    <group>access_control,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The vendor, Eleveo, was contacted early about this disclosure but did not respond in any way. There is no fixed version, no vendor advisory, no workaround published by the vendor, and no OSV-tracked package fix as of this report.

1) Immediate mitigations

• Remove network exposure of the affected endpoint. Restrict access to /qm/cz.zoom.scorecard.webui.Scorecard/cz.zoom.scorecard.webui.Scorecard/QMBODownload at the reverse proxy / WAF / load balancer so it is reachable only from trusted management networks. Since the flaw requires only low privileges (PR:L), network segmentation is the most effective immediate control.
• Enforce object-level authorization at the edge. If a reverse proxy or API gateway is in the path, add a policy that rejects requests to the download endpoint unless they originate from an authorized reporting service, blocking the abuse of leaked low-privilege accounts.
• Audit and reduce low-privilege accounts. Rotate credentials and apply least privilege, since PR:L means any foothold account enables exploitation.
• Add detection from the Detection Guidance section (WAF, Sigma, Suricata, Elastic, Splunk, Wazuh) and alert on the endpoint path and on abnormal download frequency.
• Monitor for the publicly available exploit details and treat any observed access to QMBODownload from non-reporting clients as a potential compromise.

2) Patch / upgrade steps

• No patch is currently available. Track Eleveo's channel for a Quality Management security update beyond 9.7.0.
• When a fix is released, upgrade all 9.7.0 instances and verify that the QMBODownload handler enforces object-level authorization before serving data.
• Re-contact the vendor through support channels to obtain a private fix or mitigations, given the vendor's non-response to coordinated disclosure.

3) Long-term hardening

• Authorization-by-design: ensure all download/report handlers perform server-side object-level authorization (deny-by-default) rather than relying on client-supplied identifiers.
• Centralize access-control review: include the cz.zoom.scorecard.webui.Scorecard module in regular authorization test coverage.
• Data minimization: limit what the scorecard/download path can return, reducing the sensitivity of any future disclosure.
• Network posture: never expose contact-center quality-management backends directly to the internet; require authentication at multiple layers.
• Vulnerability management: label this CVE UNPATCHED in your tracking system and re-check vendor and CVE sources periodically.

References

1. NVD — CVE-2026-101143: https://nvd.nist.gov/vuln/detail/CVE-2026-101143
2. CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
3. MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. FIRST — EPSS (score pending at time of writing): https://www.first.org/epss/
5. CISA Known Exploited Vulnerabilities Catalog (CVE not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit / threat-actor note: The NVD description states the exploit "has been made public and could be used," but no PoC code, Nuclei template, or exploit artifact is present in the supplied data, and EPSS has not yet scored this CVE. No CISA KEV listing and no named threat-actor campaign can be confirmed from available evidence. Treat the public-disclosure status as an elevated priority for mitigation despite the Medium CVSS rating.