CVE-2026-72578CWE-352csrf

CVE-2026-72578

High · published August 10, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
16.2
In the wild
Unconfirmed
What it is

A cross-site request forgery (CSRF) vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00256 · 16.2th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-08-10T15:17Z
References (2)
https://github.com/FreePBX/framework · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://github.com/FreePBX/framework/blob/release/17.0/amp_conf/htdocs/admin/libraries/BMO/Ajax.class.php · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
EPSS history
Timeline
  • 10 AUG 10:41Z
    FreePBX Framework - Missing CSRF Protection in Admin Panel Ajax Dispatcher
    cvelistv5