CVE-2026-46376
FreePBX versions 15.0.42 through before 16.0.45 and 17.0.7 contain a hard‑coded credential issue in the User Control Panel (UCP). If an administrator enables UCP but does not change the initial template credentials, unauthenticated users can log in to UCP. The vulnerability is resolved in FreePBX 16.0.45 and 17.0.7.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
sangoma freepbx
Real-world impact
An attacker could gain authenticated access to the UCP without any credentials, potentially allowing them to modify PBX settings, view call logs, or perform other administrative actions depending on UCP permissions.
Why this severity
The CVSS v4.0 base score is 9.3 (Critical) because the attack is network‑based, requires low complexity, no privileges, and no user interaction, leading to high impact on confidentiality and integrity.
What to do about it
- 01Upgrade FreePBX to version 16.0.45 or later if you are on the 16.x branch, or to version 17.0.7 or later if you are on the 17.x branch.
NVD-referenced vendor advisory
Timeline
- May 29, 2026 · May 29, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 14d agoAdvisory updatedThe NVD record was last revised.
- Jul 21, 2026 · 14d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- github.com/FreePBX/security-reporting/…mitigationvendor advisory