CVE-2026-73661: FreePBX: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted Backup
FreePBX is an open source IP PBX. Prior to 16.0.47 and 17.0.30, the FreePBX Framework module permits a crafted backup to restore the hidden AUTHTYPE setting with the value none through runRestore() in ampconf/htdocs/admin/libraries/Builtin/Restore.php. An authenticated user with sufficient backup-restore access or write access to backup files can thereby disable FreePBX authentication during restoration, bypassing the user-interface removal of AUTHTYPE=none. This issue is fixed in versions 16.0.47 and 17.0.30.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreePBX Frameworkto a version that resolves this vulnerability.Fixed in 16.0.47 - Upgrade
Upgrade
FreePBX Frameworkto a version that resolves this vulnerability.Fixed in 17.0.30
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73661?
CVE-2026-73661 has a risk score of 52, indicating a moderate level of severity.
How do I fix CVE-2026-73661?
To fix CVE-2026-73661, upgrade to FreePBX version 16.0.47 or 17.0.30 or later.
What impact does CVE-2026-73661 have on FreePBX?
CVE-2026-73661 allows an authenticated user to restore hidden AUTHTYPE settings from a crafted backup.
Are all versions of FreePBX affected by CVE-2026-73661?
Yes, all FreePBX versions prior to 16.0.47 and 17.0.30 are affected by CVE-2026-73661.
Who can exploit CVE-2026-73661?
An authenticated user with sufficient backup restoration privileges can exploit CVE-2026-73661.