PT-2026-60547 · Mwtcmi · Frogman

CVE-2026-46514 · Publicado 2026-07-16 · Atualizado 2026-07-16

Mitre

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm reset password in Tools/ResetPassword.php:48-53 returned a plaintext password and fm add extension in Tools/AddExtension.php:172 returned a plaintext secret; Frogman.class.php:2207-2211 used auditOutcome to JSON-encode those responses into oc audit log.detail, allowing any PERM READ caller with access to fm audit search to recover the stored credentials. This issue is fixed in version 1.6.2.

Correção

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

CVE-2026-46514

Produtos afetados

Frogman

Referências · 5

• https://github.com/mwtcmi/frogman/releases/tag/v1.6.2 · Nota
• https://github.com/mwtcmi/frogman/commit/02203edb613774f265ad8a21d99c4f6cf7de0d4d · Nota
• https://github.com/mwtcmi/frogman/security/advisories/GHSA-3p65-2prr-cfvf · Nota
• https://github.com/mwtcmi/frogman/releases/tag/v1.6.1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-46514 · Nota de Segurança