PT-2026-60548 · Mwtcmi · Frogman

CVE-2026-46515 · Publicado 2026-07-16 · Atualizado 2026-07-16

NVD

CVSS v4.0

9.3

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.3, PERM READ access was sufficient to call fm list managers, fm list pinsets, fm show context, fm get mcp config, fm backup status, fm whos calling, fm run saved query, and fm diagnose trunk, exposing AMI manager secrets, outbound dial PINs, full Asterisk dialplan context, root SSH connection commands, backup artifact paths, CDR history, arbitrary saved GraphQL query execution, and raw AMI endpoint dumps containing SIP fields such as password, md5 cred, and oauth secret. This issue is fixed in version 1.6.3.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-46515

Produtos afetados

Frogman

Referências · 7

• https://github.com/mwtcmi/frogman/commit/55ea257d5c24bc01c814a607faa7e76e86b111ec · Nota
• https://github.com/mwtcmi/frogman/commit/b8a8bfc12b564bcb77caef952873b9ffd4a98b00 · Nota
• https://github.com/mwtcmi/frogman/issues/25 · Nota
• https://github.com/mwtcmi/frogman/issues/13 · Nota
• https://github.com/mwtcmi/frogman/security/advisories/GHSA-q4c4-5cr4-8q47 · Nota
• https://github.com/mwtcmi/frogman/releases/tag/v1.6.3 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-46515 · Nota de Segurança