CVE-2026-46376: Sangoma FreePBX Auth Bypass Vulnerability

CVE-2026-46376 Overview

CVE-2026-46376 affects FreePBX, an open-source IP PBX platform maintained by Sangoma. The vulnerability stems from hard-coded initial template credentials in the User Control Panel (UCP) component. Unauthenticated remote attackers can access UCP accounts when administrators enable UCP but fail to rotate the default template credentials. The flaw is tracked under CWE-798: Use of Hard-coded Credentials. Affected versions span from 15.0.42 up to but not including 16.0.45 and 17.0.7. Sangoma fixed the issue in FreePBX 16.0.45 and 17.0.7.

Critical Impact

Unauthenticated network attackers can log into User Control Panel accounts using known default credentials, exposing voicemail, call records, and user-level PBX functionality.

Affected Products

• Sangoma FreePBX 15.0.42 through versions prior to 16.0.45
• Sangoma FreePBX 17.x prior to 17.0.7
• Deployments where an administrator enabled UCP without changing the default template credentials

Discovery Timeline

• 2026-05-29 - CVE-2026-46376 published to the National Vulnerability Database
• 2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-46376

Vulnerability Analysis

FreePBX ships the User Control Panel with generic template accounts used during initial provisioning. These templates contain static credentials embedded in the distribution. An administrator must authenticate to the Administrator Control Panel (ACP) to enable UCP and complete the initial setup of generic templates. After that step, the system does not force rotation or removal of the embedded template credentials.

If the administrator does not manually change those credentials, the UCP login interface accepts them from any network client. An attacker who knows the static credential pair can authenticate without prior access, account enumeration, or social engineering. The issue is classified under CWE-798, Use of Hard-coded Credentials.

Root Cause

The root cause is design-level reliance on shipped template credentials that remain valid after UCP activation. The provisioning workflow assumes the administrator will replace defaults, but no mechanism enforces this. Hard-coded values within the initial template are identical across installations, so a single disclosed credential pair is sufficient to attempt access against any unpatched deployment.

Attack Vector

Exploitation requires only network reachability to the UCP web interface. The attacker sends a standard authentication request using the known template username and password. No user interaction, privilege, or prior foothold is required. Successful authentication grants the attacker the privileges of the template UCP user, which typically includes access to voicemail, call recordings, contacts, and call-origination features tied to that account.

No public proof-of-concept exploit or exploit database entry is currently available for this CVE. The EPSS probability stands at 0.084%. Technical details are documented in the FreePBX GitHub Security Advisory GHSA-m55x-h47x-v3gx.

Detection Methods for CVE-2026-46376

Indicators of Compromise

• Successful UCP login events originating from unexpected external IP addresses or geographies
• UCP sessions using the default template account name shortly after a fresh UCP enablement
• Outbound calls, voicemail downloads, or feature changes initiated by template-named UCP users
• Multiple authentication attempts against /ucp endpoints from a single source within a short interval

Detection Strategies

• Audit Apache or Nginx access logs for HTTP POST requests to /ucp/index.php and related login handlers, correlated with source IPs outside known administrator ranges
• Query the FreePBX database for UCP user accounts that retain default template usernames after initial setup
• Compare the running FreePBX version against fixed releases 16.0.45 and 17.0.7 using fwconsole -V

Monitoring Recommendations

• Forward FreePBX web server logs and UCP application logs to a centralized SIEM for retention and correlation
• Alert on first-time successful UCP authentication from any new source IP
• Monitor for anomalous call detail records (CDRs) tied to UCP-initiated actions, including off-hours activity

How to Mitigate CVE-2026-46376

Immediate Actions Required

• Upgrade FreePBX to version 16.0.45 or 17.0.7, depending on the deployed major release
• Reset credentials on all UCP template accounts created during initial setup, even after patching
• Restrict network access to the UCP interface using firewall rules or a reverse proxy that limits source IP ranges
• Review UCP and CDR logs for unauthorized access dating back to the deployment of any affected version

Patch Information

Sangoma resolved CVE-2026-46376 in FreePBX 16.0.45 and 17.0.7. Administrators should apply the update through the FreePBX module admin or package manager. Refer to the FreePBX GitHub Security Advisory GHSA-m55x-h47x-v3gx for the official remediation guidance and version notes.

Workarounds

• Disable the UCP module until the patch can be applied if UCP is not required for operations
• Manually change all template-account credentials in UCP and verify that no account retains shipped defaults
• Place the UCP web endpoint behind a VPN or restrict it to internal management networks only

# Verify installed FreePBX version and update modules
fwconsole -V
fwconsole ma upgradeall
fwconsole reload