CVE-2026-73661: CWE-15: External Control of System or Configuration Setting in FreePBX framework
A vulnerability in the FreePBX Framework module prior to versions 16.0.47 and 17.0.30 allows an authenticated user with backup-restore or write access to backup files to restore a crafted backup that disables authentication by setting AUTHTYPE to none. This bypasses the user interface's protections and can lead to authentication bypass during restoration. The issue is fixed in versions 16.0.47 and 17.0.30.
AI Analysis
Technical Summary
CVE-2026-73661 is a CWE-15 vulnerability in the FreePBX Framework module that permits external control of a system configuration setting. Specifically, before versions 16.0.47 and 17.0.30, the runRestore() function in amp_conf/htdocs/admin/libraries/Builtin/Restore.php allows a crafted backup to restore the hidden AUTHTYPE setting with the value 'none'. An authenticated user with sufficient backup-restore privileges or write access to backup files can exploit this to disable FreePBX authentication during restoration, bypassing UI protections that prevent setting AUTHTYPE=none. This vulnerability is resolved in FreePBX Framework versions 16.0.47 and 17.0.30.
Potential Impact
An attacker with authenticated access and backup-restore or write permissions can disable authentication on the FreePBX system during restoration, effectively bypassing normal authentication controls. This could allow unauthorized access or control of the PBX system after restoration. The vulnerability has a high CVSS 4.0 score of 8.6, indicating significant impact if exploited.
Mitigation Recommendations
This vulnerability is fixed in FreePBX Framework versions 16.0.47 and 17.0.30. Users should upgrade to these or later versions to remediate the issue. No official patch or workaround is indicated beyond upgrading. Since this is not a cloud service, remediation is the responsibility of the system administrator.
CVE-2026-73661: CWE-15: External Control of System or Configuration Setting in FreePBX framework
Description
A vulnerability in the FreePBX Framework module prior to versions 16.0.47 and 17.0.30 allows an authenticated user with backup-restore or write access to backup files to restore a crafted backup that disables authentication by setting AUTHTYPE to none. This bypasses the user interface's protections and can lead to authentication bypass during restoration. The issue is fixed in versions 16.0.47 and 17.0.30.
CVSS v4.0
Score 8.6high
Affected software
pkg:github/freepbx/frameworkRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-73661 is a CWE-15 vulnerability in the FreePBX Framework module that permits external control of a system configuration setting. Specifically, before versions 16.0.47 and 17.0.30, the runRestore() function in amp_conf/htdocs/admin/libraries/Builtin/Restore.php allows a crafted backup to restore the hidden AUTHTYPE setting with the value 'none'. An authenticated user with sufficient backup-restore privileges or write access to backup files can exploit this to disable FreePBX authentication during restoration, bypassing UI protections that prevent setting AUTHTYPE=none. This vulnerability is resolved in FreePBX Framework versions 16.0.47 and 17.0.30.
Potential Impact
An attacker with authenticated access and backup-restore or write permissions can disable authentication on the FreePBX system during restoration, effectively bypassing normal authentication controls. This could allow unauthorized access or control of the PBX system after restoration. The vulnerability has a high CVSS 4.0 score of 8.6, indicating significant impact if exploited.
Mitigation Recommendations
This vulnerability is fixed in FreePBX Framework versions 16.0.47 and 17.0.30. Users should upgrade to these or later versions to remediate the issue. No official patch or workaround is indicated beyond upgrading. Since this is not a cloud service, remediation is the responsibility of the system administrator.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-13T14:04:09.605Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7e3a17bf8831d539d70450
Added to database: 08/13/2026, 21:41:43 UTC
Last enriched: 08/13/2026, 21:56:19 UTC
Last updated: 08/13/2026, 22:02:25 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.