CVE-2026-46376

Vulnerability

FreePBX versions from 15.0.42 up to (but not including) 16.0.45 and 17.0.7 contain hard-coded sample credentials in the User Control Panel (UCP) generic template setup process [1]. This optional process, when run by an administrator with authenticated access to the Admin Control Panel (ACP), creates UCP accounts with known credentials. If the administrator does not immediately change these credentials, the accounts remain accessible to anyone.

Exploitation

An unauthenticated attacker with network access to the UCP login page can exploit this vulnerability by simply using the hard-coded credentials (which are publicly known from the template) to log in [1]. No authentication, user interaction, or special privileges are required. The attacker only needs to know the default credentials that were set during the template setup.

Impact

Successful exploitation grants the attacker unauthenticated access to the UCP with the privileges of the template user. This can lead to high confidentiality and integrity impact, as the attacker may view or modify user data, call logs, and other sensitive information [1]. The CVSS 4.0 base score is 9.1 (Critical), reflecting the potential for complete compromise of UCP data.

Mitigation

The vulnerability is fixed in FreePBX versions 16.0.45 and 17.0.7 [1]. Administrators should update the userman module to the latest version, which randomizes the password for new template accounts. As a workaround, ensure that only authorized users have access to the ACP and UCP, for example by using the FreePBX Firewall module to restrict network access [1]. If the template setup has been run, manually change the credentials of any accounts created by it.