CVE-2026-101146

Executive Summary

CVE-2026-101146 is an information disclosure vulnerability in Eleveo Quality Management 9.7.0, affecting the UtilsService.createAndSaveAudit function exposed through the GWT RPC handler at /qm/cz.zoom.scorecard.webui.Scorecard/QMUtilsService. A low-privileged, remotely authenticated attacker can manipulate the request to expose sensitive information that should not be accessible at their privilege level. The vendor was contacted early but did not respond, and a public exploit has been released, making unpatched deployments at risk.

Technical Analysis

The vulnerability resides in Eleveo Quality Management 9.7.0, a contact-center quality management and workforce optimization platform. The affected component is a GWT (Google Web Toolkit) RPC handler. GWT RPC endpoints accept serialized Java objects over HTTP POST requests, dispatched to server-side service implementations based on a service interface name. Here, the relevant service is exposed at the path /qm/cz.zoom.scorecard.webui.Scorecard/QMUtilsService, and the affected method is UtilsService.createAndSaveAudit.

The flaw is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The NVD description states that "performing a manipulation results in information disclosure." This indicates that the createAndSaveAudit method does not adequately enforce authorization or input validation on the parameters supplied by the caller, allowing a user who can reach the GWT RPC endpoint to induce the service into returning or persisting data beyond their intended access scope. Because the disclosure is triggered through the createAndSaveAudit function, the attack surface is the audit-creation workflow: the manipulation likely involves crafting or altering the audit record parameters in the GWT RPC payload so that the service processes or reflects data (for example, audit content belonging to other users or system records) that the requesting principal should not be able to obtain.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N confirms the key characteristics: the attack is network-reachable (AV:N), requires no special conditions (AC:L), requires the attacker to hold low privileges on the application (PR:L), requires no user interaction (UI:N), is scoped to the vulnerable component (S:U), and results in a limited confidentiality impact (C:L) with no integrity or availability impact. The privilege requirement of PR:L means the attacker must already possess some level of authenticated access to the Eleveo platform, which limits the exposed population to authenticated users such as agents, supervisors, or other low-privileged roles.

The specific serialized parameter structure of the GWT RPC call is not documented in the available intelligence, and no exact request body, parameter names, or response fields are provided. Consequently, the precise data element disclosed (for example, audit records, user identifiers, or workflow metadata) cannot be confirmed from the source material. What can be stated with confidence is the vulnerability class (authorization/input-handling weakness leading to information disclosure) and its trigger point (the createAndSaveAudit function of the GWT RPC service). The absence of a vendor patch means the behavior remains present in version 9.7.0, and the public release of an exploit materially lowers the bar for reproduction.

Exploitation Scenarios

No public proof-of-concept code was provided in the available intelligence, and no Nuclei template or exploit artifact is tracked. The attack chain below is therefore described at the vulnerability-class level and follows directly from the NVD description; specific serialized payloads and parameter values cannot be enumerated without fabricating details not present in the source data.

1. Reconnaissance and target identification. An attacker identifies an internet- or intranet-exposed Eleveo Quality Management 9.7.0 deployment. The GWT RPC handler is reachable at the predictable path /qm/cz.zoom.scorecard.webui.Scorecard/QMUtilsService. Because the endpoint is a standard GWT RPC service, its presence can be confirmed by sending a request and observing the GWT response envelope (for example, a //OK or //EX prefixed response typical of GWT RPC). Shodan or similar internet-scanning services can locate exposed instances using the dorks listed in the metadata.

2. Privilege acquisition. Per the CVSS privilege requirement (PR:L), the attacker must hold a valid low-privileged account on the Eleveo platform. This could be obtained through legitimate provisioning (for example, a low-level agent account), credential reuse, or a separate credential-stuffing attack. Once authenticated, the attacker has a session capable of invoking the GWT RPC endpoint.

3. Triggering the flaw. The attacker crafts a GWT RPC invocation targeting UtilsService.createAndSaveAudit. The manipulation described in the NVD entry involves altering the request content such that the createAndSaveAudit operation returns or writes information outside the caller's authorized scope. At the vulnerability-class level, this is an improper access control / information exposure condition reached through crafted RPC input — not a memory-corruption or injection flaw. Because GWT RPC uses serialized Java payloads, the manipulation is performed by modifying the serialized arguments in the POST body rather than by exploiting a separate parser bug.

4. Post-exploitation impact. Successful manipulation discloses sensitive information to the low-privileged attacker. Given the nature of an audit function in a quality-management platform, the exposed data may include audit records, interaction metadata, or other users' operational data. The confidentiality impact is rated Low (C:L), indicating the exposure is bounded rather than a full platform compromise. There is no integrity or availability impact per the CVSS vector. An attacker could use the disclosed data for further reconnaissance, social engineering, or escalation against higher-value targets within the organization.

Impact Assessment

The business impact of CVE-2026-101146 is bounded but non-trivial. Eleveo Quality Management is used in contact-center environments, where the platform processes call recordings, agent performance data, customer interaction metadata, and quality-scoring records. These data sets are frequently subject to regulatory and contractual confidentiality obligations (for example, customer PII and call-content handling rules). Even a low-severity information disclosure in this context can produce compliance exposure and targeted intelligence leakage.

The CVSS score of 4.3 (Medium severity) reflects the following subscores. Confidentiality impact is Low (C:L) — some sensitive data is exposed, but the scope is constrained. Integrity impact is None (I:N) and availability impact is None (A:N). The attack vector is Network (AV:N), meaning the endpoint is reachable remotely. Attack complexity is Low (AC:L), indicating no special conditions or race windows are required. Privileges Required is Low (PR:L), so the attacker must already be an authenticated user. User interaction is None (UI:N). Scope is Unchanged (S:U), so the exploited component stays within its own security authority.

The blast radius is limited to organizations running Eleveo Quality Management 9.7.0 with the GWT RPC endpoint exposed to untrusted networks. The practical risk is elevated by two factors: the vendor has not patched or even responded to the disclosure, and a public exploit has been released. Public exploit availability, combined with Low attack complexity and the absence of any user interaction, means that any low-privileged authenticated user on an unpatched instance can reproduce the disclosure. The EPSS score has not yet been assigned by FIRST.org, so no probabilistic exploitation forecast is available from that source. CISA has not added this CVE to the KEV catalog, indicating no confirmed in-the-wild exploitation tied to known campaigns at this time — though this does not preclude opportunistic use.

Detection Guidance

Sigma Rule

title: Eleveo Quality Management GWT RPC Info Disclosure Attempt (CVE-2026-101146)
id: 8f2a9c14-7b3e-4d51-9a6c-2e5f1d0c7a44
status: experimental
description: Detects suspicious POST requests to the Eleveo QM GWT RPC handler targeting the UtilsService.createAndSaveAudit function, associated with CVE-2026-101146 information disclosure.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101146
author: Threat Intelligence
date: 2026-01-01
tags:
  - attack.t1190
  - cve.2026-101146
logsource:
  category: webserver
  product: generic
detection:
  selection_uri:
    cs-uri-stem|contains: '/qm/cz.zoom.scorecard.webui.Scorecard/QMUtilsService'
  selection_method:
    cs-method: 'POST'
  selection_service:
    cs-uri-query|contains: 'UtilsService'
  condition: selection_uri and selection_method
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs-method
  - sc-status
falsepositives:
  - Legitimate application use of the Scorecard audit workflow
level: medium

YARA Rule

rule CVE_2026_101146_Eleveo_GWT_RPC_InfoDisclosure
{
    meta:
        description = "Detects exploitation attempts against Eleveo Quality Management 9.7.0 GWT RPC UtilsService.createAndSaveAudit (CVE-2026-101146)"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-101146"
        severity = "medium"

    strings:
        $path1 = "/qm/cz.zoom.scorecard.webui.Scorecard/QMUtilsService" ascii wide nocase
        $svc1  = "UtilsService" ascii wide
        $svc2  = "createAndSaveAudit" ascii wide
        $gwt1  = "GWT-RPC" ascii wide
        $hdr1  = "Content-Type: text/x-gwt-rpc" ascii wide nocase

    condition:
        uint16(0) == 0x0A0D or
        (
            ($path1 and $svc1) or
            ($svc1 and $svc2) or
            ($hdr1 and $svc1 and $gwt1)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-101146 Eleveo QM GWT RPC UtilsService.createAndSaveAudit Information Disclosure Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/qm/cz.zoom.scorecard.webui.Scorecard/QMUtilsService"; http.request_body; content:"UtilsService"; http.request_body; content:"createAndSaveAudit"; classtype:attempted-recon; reference:cve,2026-101146; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-101146; sid:2026101146; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

network where
  http.request.method == "POST" and
  stringContains(http.request.uri, "/qm/cz.zoom.scorecard.webui.Scorecard/QMUtilsService") and
  (
    stringContains(http.request.body, "UtilsService") or
    stringContains(http.request.body, "createAndSaveAudit")
  )

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=stream:http
| eval is_target = if((match(uri, "/qm/cz\.zoom\.scorecard\.webui\.Scorecard/QMUtilsService") OR match(uri_path, "/qm/cz\.zoom\.scorecard\.webui\.Scorecard/QMUtilsService")) AND method="POST", 1, 0)
| where is_target=1
| eval svc_hit = if((match(form_data, "createAndSaveAudit") OR match(uri, "UtilsService") OR match(form_data, "UtilsService")), 1, 0)
| where svc_hit=1
| stats count min(_time) as first_seen max(_time) as last_seen values(status) as status_codes by src_ip, uri, method
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,eleveo,cve-2026-101146,">
  <rule id="101146" level="8">
    <decoded_as>json</decoded_as>
    <field name="request.method">POST</field>
    <field name="url">/qm/cz.zoom.scorecard.webui.Scorecard/QMUtilsService</field>
    <description>CVE-2026-101146: Eleveo QM GWT RPC UtilsService.createAndSaveAudit information disclosure attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_101146,</group>
  </rule>

  <rule id="101147" level="10">
    <if_sid>101146</if_sid>
    <field name="request.body">createAndSaveAudit</field>
    <description>CVE-2026-101146: Eleveo QM GWT RPC request body references createAndSaveAudit — probable exploitation attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Vendor Fix: N/A. The vendor was contacted early about this disclosure but did not respond in any way, and no fixed version has been published.

1. Immediate mitigations. Since no patch exists, compensating controls are the primary defense. Restrict network access to the GWT RPC handler at /qm/cz.zoom.scorecard.webui.Scorecard/QMUtilsService so that only trusted management networks or authorized IP ranges can reach it — place the Eleveo application behind a reverse proxy or WAF and deny direct access to the /qm/ path from untrusted networks. Enforce least privilege on interactive accounts so that as few principals as possible hold the low-privileged access needed to authenticate to the platform. Because the flaw requires an authenticated low-privileged user, tightly controlling account provisioning and rapidly disabling dormant accounts reduces the exposed attacker population. Review existing Eleveo session and account inventories for unauthorized or stale users, and enforce strong authentication (including MFA where the platform supports it) to raise the cost of obtaining the required low-privileged access.

2. Patch/upgrade steps. No official patch is available. Monitor the Eleveo vendor security advisories and release notes for Quality Management 9.7.0 and later versions. When a fixed release is published, upgrade all affected instances promptly and redeploy behind the access controls described above. Because the vendor did not respond to the disclosure, organizations should treat the timeline as uncertain and prioritize the compensating controls in the interim. Where the platform is not business-critical in its current form, consider isolating or decommissioning exposed 9.7.0 instances until a fix is confirmed.

3. Long-term hardening. Conduct a systematic review of GWT RPC exposure across Eleveo and other web applications — legacy GWT services frequently implement uneven authorization checks. Apply server-side authorization validation on every RPC method, including audit and utility functions such as createAndSaveAudit, rather than relying on UI-level access control. Deploy logging and monitoring for the detection rules in this report to catch exploitation attempts and provide forensic visibility. Include third-party contact-center and quality-management platforms in regular vulnerability management and internet-exposure reviews, and maintain an asset inventory so that out-of-band vendor products can be located and patched when advisories emerge.

References

• NVD — CVE-2026-101146: https://nvd.nist.gov/vuln/detail/CVE-2026-101146
• CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: https://cwe.mitre.org/data/definitions/200.html
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-101146 not listed)
• FIRST EPSS: https://www.first.org/epss (no score yet assigned for CVE-2026-101146)
• Eleveo product/security information: https://www.eleveo.com (monitor for vendor advisory — none published at time of writing)