CVE-2026-73661

Received Received - Intake

Authentication Bypass in FreePBX Framework Module

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

FreePBX is an open source IP PBX. Prior to 16.0.47 and 17.0.30, the FreePBX Framework module permits a crafted backup to restore the hidden AUTHTYPE setting with the value none through runRestore() in amp_conf/htdocs/admin/libraries/Builtin/Restore.php. An authenticated user with sufficient backup-restore access or write access to backup files can thereby disable FreePBX authentication during restoration, bypassing the user-interface removal of AUTHTYPE=none. This issue is fixed in versions 16.0.47 and 17.0.30.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-73661

Affected Vendors & Products

Vendor	Product	Version / Range
freepbx	freepbx	to 16.0.47 (exc)
freepbx	freepbx	to 17.0.30 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-15	One or more system settings or configuration elements can be externally controlled by a user.

Attack-Flow Graph

Executive Summary

This vulnerability affects FreePBX, an open-source IP PBX system. It allows an authenticated user with backup-restore access or write access to backup files to manipulate a hidden setting called AUTHTYPE during a backup restoration process. By setting AUTHTYPE to 'none', the user can disable FreePBX authentication entirely, bypassing normal login requirements.

Detection Guidance

Check FreePBX version with 'fwconsole show version' or 'cat /var/www/html/admin/libraries/modulefunctions.inc.php | grep FREEPBX_VERSION'. Inspect backup files for AUTHTYPE=none setting before restoration. Monitor authentication logs for unexpected access.

Impact Analysis

An attacker could exploit this to gain unauthorized access to the FreePBX system, potentially allowing them to make unauthorized changes, intercept calls, or access sensitive data. Since authentication is bypassed, the attacker could take full control of the system without needing valid credentials.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR or HIPAA. It undermines authentication controls, which are critical for protecting personal and health information, potentially resulting in legal penalties or data breaches.

Mitigation Strategies

Upgrade FreePBX to version 16.0.47 or 17.0.30 or later. Remove AUTHTYPE=none from backup files before restoration. Restrict backup-restore access to trusted users only.

Hi! I’m here to help you understand CVE-2026-73661. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70