CVE-2026-15472

Executive Summary

CVE-2026-15472 is a publicly disclosed improper authorization vulnerability in Eleveo Call Recording Software version 9.7.0. The flaw resides in the /callrec/composeEmailAction.do endpoint, allowing an unauthenticated remote attacker to bypass authorization checks and perform actions that should require elevated privileges. The vendor has been contacted but has not responded, leaving the software unpatched. The EPSS score is 0.0%, indicating low active exploitation in the wild, but the public availability of exploit details increases the risk for targeted attacks.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary Java-based enterprise application. No open-source supply chain impact is identified.

CVSS Breakdown & Threat Level

CVSS Score: 4.3 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

• Attack Vector (AV): Network – exploitable remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – no authentication needed.
• User Interaction (UI): None – no user action required.
• Scope (S): Unchanged – impact confined to the vulnerable component.
• Confidentiality (C): Low – limited information disclosure possible.
• Integrity (I): None – no data modification.
• Availability (A): None – no denial of service.

Threat Level: Medium. The vulnerability is easy to exploit but only leads to limited information disclosure. However, it could be chained with other flaws for greater impact.

Deep Dive & Mechanics

The vulnerability is an improper authorization (CWE-285) in the composeEmailAction.do servlet. The application fails to verify whether the requesting user has the necessary permissions to compose or send emails on behalf of the system. By directly crafting a POST request to this endpoint, an attacker can trigger email actions without authentication.

Root Cause: The servlet likely relies on client-side or session-based checks that can be bypassed by directly accessing the endpoint. The absence of server-side authorization validation allows any network-accessible user to invoke the action.

Attack Vector: Remote, unauthenticated HTTP requests to /callrec/composeEmailAction.do with crafted parameters.

Impact: An attacker could send arbitrary emails from the system, potentially leading to phishing attacks, information disclosure, or further compromise of internal systems.

Vulnerable vs. Patched Code

Vulnerable Code (Eleveo 9.7.0): The servlet likely lacks an authorization check:

// Vulnerable: No authorization check
public void doPost(HttpServletRequest request, HttpServletResponse response) {
    String to = request.getParameter("to");
    String subject = request.getParameter("subject");
    String body = request.getParameter("body");
    // Directly sends email without verifying user permissions
    emailService.send(to, subject, body);
}

Patched Code (Hypothetical): A proper authorization check should be added:

// Patched: Authorization check before action
public void doPost(HttpServletRequest request, HttpServletResponse response) {
    if (!userHasPermission(request.getSession(), "compose_email")) {
        response.sendError(HttpServletResponse.SC_FORBIDDEN);
        return;
    }
    String to = request.getParameter("to");
    String subject = request.getParameter("subject");
    String body = request.getParameter("body");
    emailService.send(to, subject, body);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Eleveo Call Recording Software 9.7.0
• Network access to the /callrec/composeEmailAction.do endpoint

Exploit Steps:

1. Identify the target URL: https://target/callrec/composeEmailAction.do
2. Craft a POST request with parameters to send an email:

curl -X POST https://target/callrec/composeEmailAction.do \
  -d "to=attacker@example.com&subject=Test&body=This is a test email"

3. Verify email delivery to confirm exploitation.

Expected Outcome: The email is sent without authentication, demonstrating the authorization bypass.

Blue Team

Detection:

• Monitor for POST requests to /callrec/composeEmailAction.do from unauthenticated sources.
• Alert on unusual email activity from the Eleveo server (e.g., emails to external addresses not in normal business patterns).

Hunting:

• Search logs for composeEmailAction.do with parameters to, subject, body.
• Correlate with authentication logs to identify requests without prior login.

Mitigation:

• Implement a WAF rule to block unauthenticated requests to this endpoint.
• Apply a virtual patch by adding authorization checks in a reverse proxy (e.g., Nginx auth_request).

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /callrec/composeEmailAction.do with parameters to, subject, body.
  • Outbound SMTP traffic from the Eleveo server to unexpected external addresses.
• Logs:
  • Application logs showing composeEmailAction.do accessed without a valid session.
  • Email logs showing messages sent from the system without corresponding user action.
• File System:
  • No specific file-based IOCs; the vulnerability is purely logic-based.

Detection Engineering

YARA Rule

rule CVE_2026_15472_Eleveo_Email_Action {
    meta:
        description = "Detects exploitation attempts of CVE-2026-15472 in Eleveo Call Recording"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-15472"
    strings:
        $endpoint = "/callrec/composeEmailAction.do"
        $param_to = "to="
        $param_subject = "subject="
        $param_body = "body="
    condition:
        $endpoint and ($param_to or $param_subject or $param_body)
}

Sigma Rule

title: Eleveo Call Recording Unauthorized Email Action
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated POST requests to the composeEmailAction.do endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: '/callrec/composeEmailAction.do'
    condition: selection
falsepositives:
    - Legitimate authenticated users (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-15472 Eleveo Unauthorized Email Action"; flow:to_server,established; content:"POST"; http_method; content:"/callrec/composeEmailAction.do"; http_uri; content:"to="; http_client_body; content:"subject="; http_client_body; content:"body="; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Virtual Patching: Deploy a WAF rule to block unauthenticated requests to /callrec/composeEmailAction.do.
2. Network Segmentation: Restrict access to the Eleveo server to trusted IPs only.
3. Monitoring: Enable detailed logging for the endpoint and alert on suspicious activity.

Long-Term Fix:

• The vendor must release a patch that adds server-side authorization checks. Since the vendor is unresponsive, consider migrating to an alternative solution or implementing a custom reverse proxy with authentication.

Workaround:

• Disable the email composition feature if not required, or restrict it via application configuration.

Valters IT