CVE-2026-72578: FreePBX Framework 17.0 CSRF Vulnerability

CVE-2026-72578 Overview

CVE-2026-72578 is a cross-site request forgery (CSRF) vulnerability [CWE-352] in FreePBX Framework 17.0. The flaw allows an unauthenticated remote attacker to force an authenticated administrator's browser to submit forged HTTP requests to the FreePBX administrative interface. Successful exploitation lets the attacker perform privileged actions using the victim administrator's session, including configuration changes to the PBX telephony platform.

The vulnerability requires user interaction, typically achieved by luring an authenticated administrator to a malicious page or link. No authentication is required from the attacker's side because the request executes in the administrator's authenticated context.

Critical Impact
An unauthenticated attacker can perform administrative operations on the FreePBX server by tricking a logged-in administrator into visiting an attacker-controlled page, compromising the confidentiality, integrity, and availability of the telephony platform.

Affected Products

FreePBX Framework 17.0
FreePBX administrative web interface (/admin)
The Ajax.class.php request-handling component in FreePBX Framework 17.0

Discovery Timeline

2026-08-10 - CVE-2026-72578 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72578

Vulnerability Analysis

FreePBX Framework 17.0 exposes administrative functionality through AJAX endpoints handled by Ajax.class.php under amp_conf/htdocs/admin/libraries/BMO/. The framework does not enforce anti-CSRF tokens on state-changing administrative requests. Any request that reaches the endpoint with a valid administrator session cookie is processed as legitimate.

An attacker who hosts crafted HTML, JavaScript, or an auto-submitting form on an external site can trigger requests to the FreePBX server. When an authenticated administrator loads that content in the same browser used to manage FreePBX, the browser attaches the session cookie and the server executes the action. Impacted actions include module management, dial plan modification, user creation, and other configuration changes exposed through the AJAX handlers.

Root Cause

The root cause is the absence of per-request CSRF token validation on administrative state-changing endpoints in FreePBX Framework 17.0. The application relies solely on session cookies for request authorization and does not verify that requests originate from the FreePBX interface itself. It also does not enforce a strict SameSite cookie policy or a Referer/Origin header check that would block cross-site submissions.

Attack Vector

Exploitation follows a standard CSRF flow. The attacker crafts a page containing an auto-submitting form or a fetch/XMLHttpRequest call targeted at the FreePBX admin AJAX endpoint. The attacker delivers the URL through phishing, forum posts, or a compromised third-party site. When the administrator visits the page while logged into FreePBX, the browser issues the forged request with the administrator's cookies. The server processes it as an authorized administrative action.

The attack requires that the administrator have an active session and that the FreePBX instance be reachable from the administrator's browser, including instances published to the internet or accessible from the administrator's LAN. See the FreePBX Framework repository and the Ajax class source for the affected request-handling code.

Detection Methods for CVE-2026-72578

Indicators of Compromise

Administrative changes in FreePBX audit logs that do not correspond to actions the administrator recalls performing.
HTTP requests to /admin/ajax.php or module endpoints with a Referer or Origin header pointing to an external domain.
Unexpected creation, modification, or deletion of extensions, trunks, dial plans, or admin users.

Detection Strategies

Inspect web server access logs for POST requests to FreePBX admin endpoints where the Origin or Referer header is missing or does not match the FreePBX hostname.
Correlate administrator browsing activity (proxy logs, EDR web telemetry) with FreePBX configuration change events to identify requests triggered by external pages.
Alert on anomalous timing patterns, such as administrative changes occurring immediately after an administrator visits an unusual external URL.

Monitoring Recommendations

Enable and centralize FreePBX audit logging and forward it to a SIEM for correlation.
Monitor for new outbound SIP trunks, dial plan changes, and privileged account creation as high-priority events.
Track administrator session activity, including source IP consistency and simultaneous sessions from different locations.

How to Mitigate CVE-2026-72578

Immediate Actions Required

Restrict access to the FreePBX administrative interface to trusted management networks or VPN-only reachability.
Require administrators to use a dedicated browser profile for FreePBX management and to log out immediately after use.
Review recent FreePBX audit logs for unauthorized administrative actions and roll back unexpected changes.

Patch Information

Apply the vendor-supplied update for FreePBX Framework 17.0 once available. Track the FreePBX Framework repository for fixes that introduce CSRF token validation on administrative endpoints. Until a patch is applied, treat the administrative interface as reachable only from controlled networks.

Workarounds

Enforce network-level access controls (firewall rules, reverse proxy allow-lists) that restrict /admin to authorized IP ranges.
Configure the reverse proxy or web server to reject administrative POST requests whose Origin or Referer header does not match the FreePBX hostname.
Set session cookies to SameSite=Strict where the deployment permits, to block cross-site cookie attachment.
Require administrators to authenticate through a browser session isolated from general web browsing.

bash

# Example nginx snippet enforcing Origin/Referer checks on admin POSTs
location /admin/ {
    if ($request_method = POST) {
        set $csrf_ok 0;
        if ($http_origin  ~* "^https?://pbx\.example\.com$") { set $csrf_ok 1; }
        if ($http_referer ~* "^https?://pbx\.example\.com/")  { set $csrf_ok 1; }
        if ($csrf_ok = 0) { return 403; }
    }
    proxy_pass http://freepbx_backend;
}