CVE-2026-73663

CriticalCVSS 9.3

Published: 13/08/2026(UTC)Translated: 14/08/2026(UTC)NVD NIST

Summary

FreePBX from 16.0.0 until 16.0.11 and 17.0.4 has a vulnerability in the missedcall module, where the Caller ID name from crafted SIP From headers is inserted into an SQL query without escaping. An unauthenticated caller can inject SQL when a monitored extension goes unanswered, allowing modification of administrator accounts and unauthorized remote access.

Risk Assessment

An attacker can corrupt the database and modify administrator accounts, leading to unauthorized access to the system.

Recommendation

Upgrade FreePBX to version 16.0.11 or 17.0.4, which contain the fix.

Original NVD description (English source)

FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From headers into the missedcalllog INSERT in agi-bin/missedcallnotify.php without escaping or bound parameters. An unauthenticated caller can inject SQL when a monitored extension goes unanswered, corrupting the database and modifying FreePBX administrator accounts to obtain unauthorized remote access. This issue is fixed in versions 16.0.11 and 17.0.4.