CVE-2026-73661

Katalog CVE

CVSS 6.5 · Medium EPSS 0,31%

Kerentanan External Control of System or Configuration Setting pada sangoma freepbx. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

FreePBX is an open source IP PBX. Prior to 16.0.47 and 17.0.30, the FreePBX Framework module permits a crafted backup to restore the hidden AUTHTYPE setting with the value none through runRestore() in amp_conf/htdocs/admin/libraries/Builtin/Restore.php. An authenticated user with sufficient backup-restore access or write access to backup files can thereby disable FreePBX authentication during restoration, bypassing the user-interface removal of AUTHTYPE=none. This issue is fixed in versions 16.0.47 and 17.0.30.

Rincian

Terbit di NVD

13 Agustus 2026

Terakhir diubah

9 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-15: External Control of System or Configuration Setting

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 21,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FreePBX/security-reporting/security/advisories/GHSA-f6hc-rqxg-ch86 mitigasi · advisory vendor
• https://github.com/FreePBX/framework/commit/0591581654bc269df05cbb7093645d6934d4d861 patch
• https://github.com/FreePBX/framework/commit/ea684be89abb393d1aff7f979d5fd751ff338dfd patch