CVE-2026-73665: CWE-862: Missing Authorization in FreePBX ucp
FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not consistently invoke checkAuth in node/lib/auth.js and send crafted event values containing carriage-return or newline characters through the Asterisk Manager Interface action path patched by node/lib/asterisk-manager-patch.js, allowing arbitrary commands to execute as the asterisk service user. This issue is fixed in version 17.0.9.
AI Analysis
Technical Summary
FreePBX ucp before version 17.0.9 uses io.use(checkAuth) middleware only on the default Socket.IO namespace, while custom namespaces do not consistently enforce this authorization check. An unauthenticated attacker can exploit this by connecting to these custom namespaces and sending specially crafted event values containing carriage-return or newline characters through the Asterisk Manager Interface action path, enabling arbitrary command execution as the asterisk service user. This vulnerability is identified as CWE-862 (Missing Authorization) and has a CVSS 4.0 score of 9.3, indicating critical severity. The vulnerability is fixed in FreePBX ucp version 17.0.9.
Potential Impact
An unauthenticated attacker can execute arbitrary commands on the system with the privileges of the asterisk service user by exploiting missing authorization checks in custom Socket.IO namespaces. This can lead to full compromise of the affected FreePBX system prior to version 17.0.9.
Mitigation Recommendations
Upgrade FreePBX ucp to version 17.0.9 or later, where this authorization issue is fixed. Patch status is not explicitly confirmed beyond this version fix, so ensure to apply the update promptly.
CVE-2026-73665: CWE-862: Missing Authorization in FreePBX ucp
Description
FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not consistently invoke checkAuth in node/lib/auth.js and send crafted event values containing carriage-return or newline characters through the Asterisk Manager Interface action path patched by node/lib/asterisk-manager-patch.js, allowing arbitrary commands to execute as the asterisk service user. This issue is fixed in version 17.0.9.
CVSS v4.0
Score 9.3critical
Affected software
FreePBX
ucp
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
FreePBX ucp before version 17.0.9 uses io.use(checkAuth) middleware only on the default Socket.IO namespace, while custom namespaces do not consistently enforce this authorization check. An unauthenticated attacker can exploit this by connecting to these custom namespaces and sending specially crafted event values containing carriage-return or newline characters through the Asterisk Manager Interface action path, enabling arbitrary command execution as the asterisk service user. This vulnerability is identified as CWE-862 (Missing Authorization) and has a CVSS 4.0 score of 9.3, indicating critical severity. The vulnerability is fixed in FreePBX ucp version 17.0.9.
Potential Impact
An unauthenticated attacker can execute arbitrary commands on the system with the privileges of the asterisk service user by exploiting missing authorization checks in custom Socket.IO namespaces. This can lead to full compromise of the affected FreePBX system prior to version 17.0.9.
Mitigation Recommendations
Upgrade FreePBX ucp to version 17.0.9 or later, where this authorization issue is fixed. Patch status is not explicitly confirmed beyond this version fix, so ensure to apply the update promptly.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-13T14:04:09.606Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a7e3d9bbf8831d539db73ac
Added to database: 08/13/2026, 21:56:43 UTC
Last enriched: 08/21/2026, 13:06:44 UTC
Last updated: 09/26/2026, 16:49:27 UTC
Views: 132
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.