Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-101146: Eleveo Quality Management may leak data via audit function
CVE-2026-101146 · published 20 days ago
Summary
The Eleveo Quality Management 9.7.0 software can unintentionally expose internal information when its audit‑recording feature is used. This can be triggered from outside the network, allowing attackers to see data they should not. Apply the vendor’s patch or update to a secured version as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| eleveo | quality management | 9.7.0 |
Original advisory text
Eleveo Quality Management GWT RPC QMUtilsService UtilsService.createAndSaveAudit information disclosure
A security flaw has been discovered in Eleveo Quality Management 9.7.0. This issue affects the function UtilsService.createAndSaveAudit of the file /qm/cz.zoom.scorecard.webui.Scorecard/QMUtilsService of the component GWT RPC Handler. Performing a manipulation results in information disclosure. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
2.1
Low
Type
CWE-200Information Exposure
CWE-284Improper Access Control
Timeline
Published28 Sep 2026
Updated19 Oct 2026
First seen28 Sep 2026
Track software like this
Free during beta