Sangoma: FreePBX Vulnerability Allow Attackers to Gain Access to User Portals

Critical FreePBX Vulnerability Exposes User Portals to Unauthenticated Attacks

A severe security flaw in the open-source IP PBX platform FreePBX (CVE-2026-46376) allows unauthenticated attackers to gain access to user portals via hard-coded credentials in the User Control Panel (UCP). The vulnerability affects FreePBX versions prior to 16.0.45 and 17.0.7, stemming from default credentials embedded in the userman module’s generic template during setup.

The issue arises when administrators fail to modify default credentials after deployment, leaving systems exposed. Attackers can exploit this flaw without prior access, privileges, or user interaction, making it particularly dangerous in exposed environments. Classified under CWE-798 (Use of Hard-coded Credentials), the vulnerability carries a CVSS v4 score of 9.1 (Critical) due to its low-complexity, network-based attack vector.

Successful exploitation could lead to:

• Unauthorized access to user accounts via the UCP.
• Exposure of sensitive data.
• Manipulation of user settings and configurations.

The flaw was introduced in a 2021 code change and publicly disclosed under advisory GHSA-m55x-h47x-v3gx by researcher chrsmj, with remediation developed by Sangoma. FreePBX has released patches version 16.0.45+ for FreePBX 16 and 17.0.7+ for FreePBX 17 to address the issue.

Organizations are urged to audit deployments for unmodified default credentials and implement additional security measures, such as restricting UCP/ACP access via VPN, MFA, or IP-based restrictions. The incident highlights the risks of insecure default configurations in enterprise systems.

Source: https://cybersecuritynews.com/freepbx-vulnerability/

Sangoma cybersecurity rating report: https://www.rankiteo.com/company/sangoma

"id": "SAN1779287064",
"linkid": "sangoma",
"type": "Vulnerability",
"date": "1/2021",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'industry': 'Telecommunications/VoIP',
                        'name': 'FreePBX',
                        'type': 'Software Platform'}],
 'attack_vector': 'Network-based',
 'data_breach': {'sensitivity_of_data': 'High (user settings, configurations)',
                 'type_of_data_compromised': 'User account data, sensitive '
                                             'configurations'},
 'description': 'A severe security flaw in the open-source IP PBX platform '
                'FreePBX (CVE-2026-46376) allows unauthenticated attackers to '
                'gain access to user portals via hard-coded credentials in the '
                'User Control Panel (UCP). The vulnerability affects FreePBX '
                'versions prior to 16.0.45 and 17.0.7, stemming from default '
                'credentials embedded in the userman module’s generic template '
                'during setup. Attackers can exploit this flaw without prior '
                'access, privileges, or user interaction, making it '
                'particularly dangerous in exposed environments.',
 'impact': {'data_compromised': 'Sensitive data exposure',
            'operational_impact': 'Unauthorized access to user accounts, '
                                  'manipulation of user settings and '
                                  'configurations',
            'systems_affected': 'FreePBX User Control Panel (UCP)'},
 'lessons_learned': 'Highlights risks of insecure default configurations in '
                    'enterprise systems',
 'post_incident_analysis': {'corrective_actions': 'Patches released (FreePBX '
                                                  '16.0.45+ and 17.0.7+), '
                                                  'removal of hard-coded '
                                                  'credentials',
                            'root_causes': 'Hard-coded credentials in the '
                                           'userman module’s generic template '
                                           '(introduced in 2021 code change)'},
 'recommendations': 'Audit deployments for unmodified default credentials, '
                    'implement additional security measures (VPN, MFA, '
                    'IP-based restrictions)',
 'references': [{'source': 'GitHub Advisory', 'url': 'GHSA-m55x-h47x-v3gx'}],
 'response': {'containment_measures': 'Patches released (FreePBX 16.0.45+ and '
                                      '17.0.7+)',
              'remediation_measures': 'Audit deployments for unmodified '
                                      'default credentials, restrict UCP/ACP '
                                      'access via VPN/MFA/IP-based '
                                      'restrictions'},
 'title': 'Critical FreePBX Vulnerability Exposes User Portals to '
          'Unauthenticated Attacks',
 'type': 'Vulnerability Exploitation',
 'vulnerability_exploited': 'CVE-2026-46376 (Use of Hard-coded Credentials - '
                            'CWE-798)'}