CVE-2026-46515
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
In Frogman prior to version 1.6.3, users with PERM_READ access could call sensitive API functions, exposing AMI secrets, outbound dial PINs, Asterisk dialplan contexts, SSH commands, backup paths, CDR history, and raw AMI dumps with SIP fields (passwords, md5_cred, oauth_secret).
Risk Assessment
The organization risks leakage of confidential credentials and configuration data, potentially leading to unauthorized PBX access, call eavesdropping, and takeover of telephony infrastructure.
Recommendation
Upgrade Frogman to version 1.6.3 or later immediately, and review and restrict PERM_READ permissions to prevent unauthorized access to sensitive functions.
Original NVD description (English source)
Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.3, PERM_READ access was sufficient to call fm_list_managers, fm_list_pinsets, fm_show_context, fm_get_mcp_config, fm_backup_status, fm_whos_calling, fm_run_saved_query, and fm_diagnose_trunk, exposing AMI manager secrets, outbound dial PINs, full Asterisk dialplan context, root SSH connection commands, backup artifact paths, CDR history, arbitrary saved GraphQL query execution, and raw AMI endpoint dumps containing SIP fields such as password, md5_cred, and oauth_secret. This issue is fixed in version 1.6.3.