CVE-2025-55210 is a privilege context switching error (CWE-270) affecting the FreePBX API module in versions prior to 17.0.5 and 16.0.17. FreePBX is an open-source GUI managing Asterisk PBX systems, widely used for telephony management. The vulnerability allows authenticated users with REST or GraphQL API access to forge JSON Web Tokens (JWTs) signed with the api-oauth.key private key, effectively granting them full access to the API regardless of their original privilege level. The JWT forgery bypasses traditional authorization by specifying arbitrary scopes such as 'rest' or 'gql'. However, the token must include a JWT ID (jti) claim that exists in the api_access_tokens table of the asterisk MySQL database, which restricts the attack to those who can guess or obtain a valid jti value. This means the attacker must already have some level of access to the system or database to exploit the vulnerability fully. The vulnerability arises from improper privilege context switching and insufficient validation of JWT tokens. It is fixed in FreePBX versions 17.0.5 and 16.0.17. The CVSS 4.0 vector indicates network attack vector, high attack complexity, partial authentication required, user interaction needed, and low impact on confidentiality, integrity, and availability. No public exploits have been reported to date.

For European organizations, this vulnerability poses a risk of unauthorized privilege escalation within FreePBX telephony management systems. Attackers who gain low-level authenticated access could escalate to full API control, potentially allowing them to manipulate telephony configurations, intercept or redirect calls, disrupt communications, or access sensitive call data. This could impact business continuity, confidentiality of communications, and regulatory compliance, especially for sectors relying heavily on VoIP and telephony infrastructure such as finance, healthcare, and government. The requirement to know a valid jti reduces the likelihood of widespread exploitation but does not eliminate risk, particularly for insiders or attackers who have already compromised parts of the system. The low CVSS score reflects limited ease of exploitation and impact, but the critical nature of telephony systems means even low-severity vulnerabilities warrant prompt remediation.

European organizations using FreePBX should immediately upgrade affected instances to versions 17.0.5 or 16.0.17 or later to remediate this vulnerability. Additionally, organizations should: 1) Restrict API access to trusted users and networks to minimize exposure. 2) Regularly audit and monitor api_access_tokens database entries for suspicious or unauthorized JWT IDs. 3) Rotate the api-oauth.key private key periodically and after any suspected compromise to invalidate forged tokens. 4) Implement network segmentation and strong authentication controls around FreePBX management interfaces. 5) Employ logging and alerting on anomalous API usage patterns that could indicate token forgery attempts. 6) Conduct internal security reviews to ensure no unauthorized access to the MySQL database storing JWT IDs. These steps reduce the attack surface and help detect or prevent exploitation attempts beyond patching.