CVE-2026-40520 is an OS command injection vulnerability in FreePBX api module version 17.0.8 and prior. The issue arises in the initiateGqlAPIProcess() function where user-supplied GraphQL mutation input fields are passed unsanitized to shell_exec(), allowing an authenticated attacker with a valid bearer token to execute arbitrary shell commands on the underlying host as the web server user. This vulnerability is classified under CWE-78 and has a CVSS 4.0 base score of 8.6, indicating high severity. No patch or official remediation level has been disclosed as of the publication date.

Successful exploitation allows an authenticated attacker to execute arbitrary commands on the host system with the privileges of the web server user. This could lead to unauthorized system access, data compromise, or further system compromise depending on the commands executed. The vulnerability requires authentication with a valid bearer token, limiting exploitation to authorized users or those who have obtained credentials.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the FreePBX api module to trusted users only and monitor for suspicious activity involving GraphQL mutations. Avoid exposing the vulnerable API to untrusted networks. Follow vendor channels for updates on patches or official mitigations.