CVE-2026-73663: FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover
FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From headers into the missedcalllog INSERT in agi-bin/missedcallnotify.php without escaping or bound parameters. An unauthenticated caller can inject SQL when a monitored extension goes unanswered, corrupting the database and modifying FreePBX administrator accounts to obtain unauthorized remote access. This issue is fixed in versions 16.0.11 and 17.0.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreePBX missedcall moduleto a version that resolves this vulnerability.Fixed in 16.0.11 - Upgrade
Upgrade
FreePBX missedcall moduleto a version that resolves this vulnerability.Fixed in 17.0.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73663?
CVE-2026-73663 has a severity rating of 89, indicating a high risk vulnerability.
How do I fix CVE-2026-73663?
To fix CVE-2026-73663, upgrade FreePBX to version 16.0.12 or later.
What is the impact of CVE-2026-73663?
The impact of CVE-2026-73663 allows unauthenticated attackers to execute SQL injection attacks that can lead to administrator takeover.
Which versions of FreePBX are affected by CVE-2026-73663?
CVE-2026-73663 affects FreePBX versions from 16.0.0 to 16.0.11 and 17.0.4.
What type of vulnerability is CVE-2026-73663?
CVE-2026-73663 is classified as an SQL Injection vulnerability.