PT-2026-60548 · Mwtcmi · Frogman

CVE-2026-46515 · Published 2026-07-16 · Updated 2026-07-16

NVD

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.3, PERM READ access was sufficient to call fm list managers, fm list pinsets, fm show context, fm get mcp config, fm backup status, fm whos calling, fm run saved query, and fm diagnose trunk, exposing AMI manager secrets, outbound dial PINs, full Asterisk dialplan context, root SSH connection commands, backup artifact paths, CDR history, arbitrary saved GraphQL query execution, and raw AMI endpoint dumps containing SIP fields such as password, md5 cred, and oauth secret. This issue is fixed in version 1.6.3.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-46515

Affected Products

Frogman

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-46515 · Security Note
• https://github.com/mwtcmi/frogman/commit/55ea257d5c24bc01c814a607faa7e76e86b111ec · Note
• https://github.com/mwtcmi/frogman/commit/b8a8bfc12b564bcb77caef952873b9ffd4a98b00 · Note
• https://github.com/mwtcmi/frogman/issues/25 · Note
• https://github.com/mwtcmi/frogman/issues/13 · Note
• https://github.com/mwtcmi/frogman/security/advisories/GHSA-q4c4-5cr4-8q47 · Note
• https://github.com/mwtcmi/frogman/releases/tag/v1.6.3 · Note