Cross-Site Request Forgery Vulnerability in FreePBX Framework by Sangoma Technologies
CVE-2026-72578

8.8HIGH

Key Information:

Vendor

Freepbx

Status
Freepbx Framework
Vendor
CVE Published:
10 August 2026

What is CVE-2026-72578?

A cross-site request forgery (CSRF) vulnerability in FreePBX Framework 17.0 permits an unauthenticated remote attacker to execute administrative actions as if they were an authenticated administrator. This can lead to unauthorized changes to the system, potentially compromising the integrity and functionality of the telephony framework. The flaw is primarily located in the Ajax.class.php file, where inadequate validation of incoming requests allows for malicious exploitation.

Affected Version(s)

FreePBX Framework 17.0

References

https://github.com/FreePBX/framework
third-party-advisory
https://github.com/FreePBX/framework/blob/release/17.0/am...
technical-description

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Adrian Gaitan
.