CVE-2026-73663
Received Received - Intake

SQL Injection in FreePBX Missedcall Module

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description
FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From headers into the missedcalllog INSERT in agi-bin/missedcallnotify.php without escaping or bound parameters. An unauthenticated caller can inject SQL when a monitored extension goes unanswered, corrupting the database and modifying FreePBX administrator accounts to obtain unauthorized remote access. This issue is fixed in versions 16.0.11 and 17.0.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-73663

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
freepbx missedcall From 16.0.0 (inc) to 16.0.11 (inc)
freepbx missedcall 17.0.4
freepbx freepbx *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in FreePBX, an open-source IP PBX system. It affects the missedcall module versions 16.0.0 to 16.0.11 and 17.0.4. The issue occurs because the module does not properly escape or use bound parameters when inserting Caller ID names from crafted SIP From headers into the missedcalllog database. An unauthenticated attacker can exploit this to inject SQL commands when a monitored extension goes unanswered.

Impact Analysis

This vulnerability allows an attacker to corrupt the FreePBX database and modify administrator accounts. This could lead to unauthorized remote access to the system, potentially allowing the attacker to make calls, access sensitive data, or disrupt phone services. Systems running affected versions are at risk if exposed to untrusted networks.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Unauthorized access to call logs or administrator accounts could result in data exposure, fines, or legal consequences depending on the data processed by the system.

Mitigation Strategies

Upgrade FreePBX to version 16.0.11 or 17.0.4 or later to patch the missedcall module SQL injection vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73663. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart