Critical · published August 28, 2025
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.
🚨 A staggering flaw in FreePBX lets anyone waltz in—unauthenticated users can access the admin interface and run wild! 🔥 Think of FreePBX as a restaurant with no lock on the door. Any passerby can stroll right in, change the menu, or mess with the cash register without anyone batting an eye. It’s a recipe for disaster! With this vulnerability, attackers can manipulate your entire database, potentially leading to complete control over your system. They could change configurations, steal sensitive data, or even execute malicious code—an absolute nightmare for your operations!
Think of FreePBX as a restaurant with no lock on the door. Any passerby can stroll right in, change the menu, or mess with the cash register without anyone batting an eye. It’s a recipe for disaster! This flaw arises from insufficiently sanitizing user-supplied data, allowing unauthenticated access to the FreePBX Administrator. Versions 15, 16, and 17 are particularly at risk and can be compromised with ease.
With this vulnerability, attackers can manipulate your entire database, potentially leading to complete control over your system. They could change configurations, steal sensitive data, or even execute malicious code—an absolute nightmare for your operations! Immediately update your FreePBX installations to versions 15.0.66, 16.0.89, or 17.0.3 to close this alarming security hole. Additionally, review user access controls to ensure that no unauthorized access goes unaddressed. 🔒 You’ve got this! Patch those systems and secure your FreePBX against unwanted guests! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| sangoma/freepbx | ≥ 15.0, < 15.0.66 | 15.0.66 |
| sangoma/freepbx | ≥ 16.0, < 16.0.89 | 16.0.89 |
| sangoma/freepbx | ≥ 17.0, < 17.0.3 | 17.0.3 |