PT-2026-42119 · Freepbx · Freepbx

S0Nnywt · Published 2026-05-20 · Updated 2026-06-01 · CVE-2026-46376

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FreePBX (affected versions not specified)

Description Hardcoded credentials in the Userman module allow unauthenticated access to the portal, potentially exposing business phone systems.

Recommendations Update the installed modules to the latest version.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2026-46376

GHSA-M55X-H47X-V3GX

Affected Products

Freepbx

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46376.json · Exploit
• https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m55x-h47x-v3gx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46376 · Security Note
• https://osv.dev/vulnerability/CVE-2026-46376 · Vendor Advisory
• https://reddit.com/r/KibernetinisSaugumas/comments/1tjs758/kibernetinio_saugumo_radar_20260521 · Reddit Post
• https://twitter.com/CCBalert/status/2061455460423643537 · Twitter Post
• https://twitter.com/fofabot/status/2057406698227404938 · Twitter Post
• https://twitter.com/UndercodeNews/status/2057043477196636482 · Twitter Post
• https://twitter.com/DIYprojects55/status/2057188996271448439 · Twitter Post
• https://pbxscience.com/freepbx-user-management-hit-by-critical-hard-coded-credentials-flaw · Reddit Post
• https://twitter.com/vuln_tracker/status/2057640908552867994 · Twitter Post
• https://twitter.com/ADKCyber/status/2060712429940806020 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2056937334898389329 · Twitter Post