CVE-2026-72578: FreePBX Framework - Missing CSRF Protection in Admin Panel Ajax Dispatcher
A cross-site request forgery (CSRF) vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreePBX Frameworkto a version that resolves this vulnerability.Fixed in 17.0 - Configuration
Add/enable CSRF token generation and server-side validation in the /admin/ajax.php dispatcher implemented in amp_conf/htdocs/admin/libraries/BMO/Ajax.class.php so that administrative actions cannot be triggered without a valid CSRF token.
FreePBX Framework admin panel Ajax dispatcher (/admin/ajax.php) (amp_conf/htdocs/admin/libraries/BMO/Ajax.class.php) CSRF protection for Ajax administrative actions = Implement CSRF tokens and validate them for admin Ajax requests; do not rely on Referer header checks
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72578?
CVE-2026-72578 has a severity rating of high at 8.8.
How do I fix CVE-2026-72578?
To fix CVE-2026-72578, update your FreePBX Framework to the latest version that includes CSRF protection.
What actions can an attacker perform due to CVE-2026-72578?
An attacker can perform administrative actions on behalf of an authenticated administrator due to the CSRF vulnerability.
Is CVE-2026-72578 remotely exploitable?
Yes, CVE-2026-72578 is remotely exploitable as it allows an unauthenticated attacker to execute actions.
What component is affected by CVE-2026-72578?
The vulnerability affects the admin panel Ajax dispatcher in the FreePBX Framework's libraries.