CVE-2026-46376
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
A vulnerability in FreePBX from version 15.0.42 to before 16.0.45 and 17.0.7 allows unauthenticated users to access the User Control Panel (UCP) using hard-coded initial template credentials if the administrator did not change them immediately after enabling UCP. This issue is fixed in versions 16.0.45 and 17.0.7.
Risk Assessment
The risk involves unauthorized access to UCP by unauthenticated users, potentially leading to data confidentiality and integrity breaches and takeover of the telephony system.
Recommendation
It is recommended to immediately upgrade FreePBX to version 16.0.45 or 17.0.7 and change the default UCP template credentials to unique and strong passwords.
Original NVD description (English source)
FreePBX is an open source IP PBX. From 15.0.42 to before 16.0.45 and 17.0.7, unauthenticated users may be able to access the User Control Panel (UCP) using hard-coded initial template credentials if these were not immediately changed by the Administrator who enabled UCP. Authenticated access to ACP is required for the initial setup of UCP generic templates, but after that, without further steps by the admin, unauthenticated users may be able to gain access. This vulnerability is fixed in 16.0.45 and 17.0.7.