CVE-2026-44237

Vulnerability

The FreePBX api module prior to version 17.0.8 contains an OAuth2 implementation flaw in the ClientRepository.php file. The validateClient() method unconditionally returns true, so any party with knowledge of a valid client_id can obtain OAuth2 access tokens without providing the matching client_secret. The API module must be installed and at least one OAuth2 application configured. By default, the client_id is a random 64-character string that is not brute-forceable [1].

Exploitation

An attacker must first obtain a valid client_id, which requires either authenticated access to the FreePBX Administrator Control Panel (ACP) or access to a backup of the system. With that client_id, the attacker can directly request tokens via the client_credentials grant, bypassing the client_secret check entirely. No additional network position or user interaction is required beyond having that client_id [1].

Impact

Successfully obtaining an access token with the default gql scope grants the attacker full read/write access to all GraphQL mutations and queries. This leads to complete compromise of the FreePBX system's data and configuration, i.e., high confidentiality and integrity impact [1].

Mitigation

Update the api module to FreePBX 17.0.8 or later, released 2026-05-29. Additionally, restrict access to the FreePBX ACP to authorized users only (e.g., using User Management, SysAdmin VPN, MFA, or SAML modules), block hostile networks via the FreePBX Firewall module, and secure backups [1].