CVE-2026-101144

Executive Summary

CVE-2026-101144 is an improper access control vulnerability (CWE-266) in Eleveo Call Recording Software version 9.7.0, affecting the /callrec/searchAction.do endpoint within the Query Builder component. A remote, authenticated attacker with low privileges can exploit this flaw to access or manipulate data beyond their authorized scope, resulting in low-level confidentiality, integrity, and availability impacts (CVSS 6.3). The exploit has been publicly disclosed, the vendor has not responded, and no patch is currently available, making this a persistent risk for exposed Eleveo deployments.

Technical Analysis

The vulnerability resides in the Query Builder component of Eleveo Call Recording Software 9.7.0, specifically within the /callrec/searchAction.do file. According to the NVD description, the flaw is classified as improper access controls (CWE-266 — Incorrect Privilege Assignment). This class of vulnerability occurs when a system fails to correctly enforce authorization boundaries, allowing a user to perform actions or access resources that should be restricted to higher-privileged roles.

The attack surface is the web-facing /callrec/searchAction.do endpoint. The Query Builder likely allows users to construct and execute search queries against call recording metadata or content. Due to improper access controls, an authenticated low-privilege user can manipulate the request to bypass intended authorization checks. The NVD description explicitly states that "this manipulation causes improper access controls," indicating that the vulnerability is triggered by manipulating input to the endpoint, which then bypasses access control logic.

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) confirms:

• Network exploitable (AV:N): The vulnerability can be triggered remotely over the network.
• Low attack complexity (AC:L): No specialized conditions or race conditions are required.
• Low privileges required (PR:L): The attacker must be authenticated with basic user rights.
• No user interaction (UI:N): Exploitation does not require a victim to perform any action.
• Unchanged scope (S:U): The impact is confined to the vulnerable component.
• Low confidentiality, integrity, and availability impact (C:L/I:L/A:L): The attacker can read limited data, make limited modifications, and cause limited disruption.

The exact code-level mechanism (e.g., missing role checks, insecure direct object references, or parameter tampering) is not detailed in the available NVD description. However, the vulnerability class suggests that the application fails to validate whether the authenticated user has the necessary permissions to execute certain queries or access specific call records. The public disclosure implies that a proof-of-concept or exploit details may be available, but no exploit code or Nuclei template has been identified in this dataset.

Exploitation Scenarios

1. Reconnaissance and target identification: An attacker identifies an internet-exposed Eleveo Call Recording Software instance, likely via Shodan or similar scanning tools. The attacker obtains valid low-privilege credentials, either through default accounts, credential stuffing, or as a legitimate but malicious insider.

2. Triggering the flaw: The attacker authenticates to the Eleveo web interface and navigates to the Query Builder functionality. They then send a crafted request to /callrec/searchAction.do, manipulating parameters to bypass intended access controls. The exact manipulation is not specified in the available data, but it likely involves altering query parameters or request payloads to access records or perform actions reserved for administrators or higher-privileged users.

3. Payload/execution method: At the vulnerability-class level, the attacker leverages improper access controls to execute queries or retrieve data that should be restricted. This could involve modifying query filters, changing record IDs, or injecting parameters that cause the server to return unauthorized results. No public proof-of-concept is available; the attack chain is inferred from the vulnerability class and the limited details in the NVD description.

4. Post-exploitation impact: Successful exploitation allows the attacker to access call recordings, metadata, or other sensitive information beyond their authorization level. They may also modify or delete data, leading to integrity and availability impacts. Given the low CVSS impact scores, the immediate damage is limited, but the compromised data could include sensitive customer conversations, personally identifiable information (PII), or business intelligence, leading to regulatory and reputational consequences. The attacker could also use the access to further enumerate the system or pivot to other internal resources.

Impact Assessment

The business impact of CVE-2026-101144 is significant for organizations using Eleveo Call Recording Software 9.7.0. Call recording systems often store sensitive customer interactions, including financial details, health information, and personal data, making them attractive targets for attackers and a compliance concern (e.g., GDPR, HIPAA, PCI DSS). The vulnerability allows a low-privileged authenticated user to bypass access controls and access or manipulate data they should not be able to, potentially leading to unauthorized disclosure and modification of call recordings.

The blast radius is limited to the Eleveo application and its data; the CVSS scope is unchanged (S:U). However, the low attack complexity and network exploitability mean that any authenticated user with basic rights can exploit it, widening the threat actor pool to include malicious insiders or attackers who have obtained low-privilege credentials. The CVSS subscores indicate low confidentiality (C:L), integrity (I:L), and availability (A:L) impacts, suggesting that the attacker can access a limited amount of data, make limited changes, and cause limited disruption. However, in the context of call recordings, even limited access can expose highly sensitive information.

No public proof-of-concept or exploit code has been observed, but the vulnerability has been publicly disclosed, which increases the likelihood of exploitation attempts. The vendor has not responded, and no patch is available, leaving organizations with no official remediation path.

Detection Guidance

Sigma Rule

title: Eleveo Call Recording Improper Access Control Exploitation Attempt
id: 3f8c2b1a-9d4e-4f7a-8b2c-1e5d6f7a8b9c
status: experimental
description: Detects suspicious requests to /callrec/searchAction.do that may indicate exploitation of CVE-2026-101144 (improper access controls).
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
  product: apache
  service: access_combined
detection:
  selection_endpoint:
    cs-uri-stem|endswith: '/callrec/searchAction.do'
  selection_anomaly:
    cs-uri-query|contains:
      - 'role='
      - 'admin='
      - 'privilege='
      - 'user='
      - 'id='
      - 'record='
  condition: selection_endpoint and selection_anomaly
falsepositives:
  - Legitimate administrative queries with role parameters
level: medium
tags:
  - attack.t1190
  - cve.2026.101144

YARA Rule

rule CVE_2026_101144_Eleveo_Access_Control
{
    meta:
        description = "Detects exploitation attempts for CVE-2026-101144 in Eleveo Call Recording Software"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-101144"
        severity = "medium"

    strings:
        $endpoint = "/callrec/searchAction.do" ascii wide nocase
        $param1 = "searchAction" ascii wide nocase
        $param2 = "QueryBuilder" ascii wide nocase

    condition:
        any of ($endpoint, $param1, $param2)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-101144 Eleveo Call Recording Improper Access Control Attempt"; flow:to_server,established; content:"/callrec/searchAction.do"; http_uri; content:"searchAction"; http_uri; classtype:attempted-user; sid:10000001; rev:1; reference:cve,2026-101144;)

Elastic Detection

sequence by host.id with maxspan=5s
  [ network where network.protocol == "http" and url.path == "/callrec/searchAction.do" and http.request.method == "POST" ]
  [ network where network.protocol == "http" and url.path == "/callrec/searchAction.do" and http.response.status_code == 200 ]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="/callrec/searchAction.do"
| stats count by src_ip, http_method, status, useragent
| where count > 5

Wazuh OSSEC Rule

<group name="web,access_control,">
  <rule id="100100" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>/callrec/searchAction.do</url>
    <description>CVE-2026-101144: Eleveo Call Recording improper access control attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_101144,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• Restrict network access to the Eleveo web interface to trusted IP ranges or VPN only.
• Enforce strong authentication and the principle of least privilege for all Eleveo users; audit existing accounts for excessive permissions.
• Implement a web application firewall (WAF) with custom rules to block anomalous requests to /callrec/searchAction.do, focusing on parameter tampering or unusual query patterns.
• Monitor logs for suspicious activity targeting the Query Builder endpoint.

2. Patch/upgrade steps:

• No patch is currently available. The vendor was contacted but did not respond. Organizations should continuously monitor Eleveo's official channels for security updates and apply them as soon as they are released.
• If the vendor remains unresponsive, consider evaluating alternative call recording solutions or isolating the Eleveo instance from sensitive data.

3. Long-term hardening:

• Conduct a thorough review of access control mechanisms in Eleveo, particularly around the Query Builder and /callrec/searchAction.do.
• Implement role-based access control (RBAC) with strict separation of duties.
• Perform regular security assessments and penetration testing of call recording systems.
• Adopt a vulnerability management program that includes timely patching and compensating controls for unpatchable systems.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-101144
• CWE-266: https://cwe.mitre.org/data/definitions/266.html
• MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/
• Vendor: https://www.eleveo.com/ (no advisory available; vendor did not respond to disclosure)
• CISA KEV: Not applicable (CVE not listed)