Security

Topic	Replies	Views	Activity
About the Security category This category contains posts related to security announcements and updates. Please review the FreePBX Security Policy on GitHub before posting here. There is also a FreePBX Security section of the forums.	2	1272	October 24, 2024
:green_circle: Authenticated but Broken access control in the FreePBX framework GraphQL API framework , security , v17 , v16 , graphql	0	48	August 31, 2026
:green_circle: Authenticated admin with limited privileges can escalate perms via Framework BMO AJAX dispatcher framework , security , v17 , v16	0	42	August 24, 2026
:orange_circle: Authenticated RCE in FindMeFollowMe function of Sangoma Connect security , v17 , v16	0	44	August 24, 2026
:green_circle: Authenticated Backup Metadata Hooks Execution Bypass backup , security , v17 , v16 , backup-restore	0	36	August 24, 2026
:green_circle: Authenticated Backup GraphQL Restore Filename Command Injection backup , security , v17 , v16 , backup-restore	0	39	August 24, 2026
:orange_circle: Unauthenticated RCE via SQL injection in Sangoma Connect RT API login firewall , security , v17 , v16	0	67	August 21, 2026
:orange_circle: Unauthenticated Missing Authorization in FreePBX UCP allows reset/overwrite of any user's dashboard templates ucp , security , v17 , v16	0	61	August 21, 2026
:orange_circle: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover security , v17 , v16 , missedcall	3	133	August 16, 2026
:red_circle: Unauthenticated remote code execution in FreePBX UCP via socket.io namespace auth bypass and AMI action injection ucp , security , v17	4	206	August 16, 2026
:green_circle: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted Backup backup , security , v17 , v16 , backup-restore	1	52	August 15, 2026
:green_circle: Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files moh , security , v17	1	52	August 15, 2026
:green_circle: Authenticated TTS AGI Command Injection Through TTS Name security , v17 , v16 , tts	1	54	August 15, 2026
Authenticated Arbitrary SSH Key Injection via Backup Module backup , v17	1	58	August 8, 2026
Authenticated API generatedocs Host Command Injection v17 , graphql	1	56	August 8, 2026
Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module asterisk , moh , security , v17 , v16	14	288	July 17, 2026
Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Module security , v17 , v16 , backup-restore	1	68	July 12, 2026
Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module modules , security , v17 , v16	1	51	July 12, 2026
Authenticated Command Injection in FreePBX UCP Interface ucp , security , v17 , v16	1	81	July 12, 2026
Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion) superfecta , security , v17 , v16	1	55	July 12, 2026
Authenticated security issues in cdr and dashboard cdr , dashboard , security	0	93	May 19, 2026
Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface GHSA-m55x-h47x-v3gx CVE-2026-46376 ucp , security	1	342	May 15, 2026
API module security issues published today - CVE-2026-41410 and CVE-2026-44237 security , v17 , v16 , graphql	2	181	May 12, 2026
Exemplified doubts about CVSS implementations asterisk , core , freepbx , security	18	659	June 9, 2026
Security Advisory: Please Lock Down Your Administrator Access configuration , bug , firewall , freepbx	138	15265	September 18, 2025
Security Advisory: Unauthenticated Denial Of Service bug , freepbx , framework , security	10	660	September 29, 2025
Unable to update challenge :: authorization must be pending letsencrypt	2	2408	August 8, 2022
How can this happen? Unauthorized access again!	50	4248	October 16, 2020
Holistic FreePBX Security: Engineering protection from the Big Bad Wolf	2	2581	May 15, 2026
Critical FreePBX RCE Vulnerability (ALL Versions) CVE-2014-7235	83	44233	November 22, 2014

About the Security category

This category contains posts related to security announcements and updates. Please review the FreePBX Security Policy on GitHub before posting here. There is also a FreePBX Security section of the forums.