EUVD Vulnerability Catalog

EUVD-2026-33295

Severity: CRITICAL Base Score: 9.3 CVSS Version: 4.0

Vulnerability Description

FreePBX is an open source IP PBX. From 15.0.42 to before 16.0.45 and 17.0.7, unauthenticated users may be able to access the User Control Panel (UCP) using hard-coded initial template credentials if these were not immediately changed by the Administrator who enabled UCP. Authenticated access to ACP is required for the initial setup of UCP generic templates, but after that, without further steps by the admin, unauthenticated users may be able to gain access. This vulnerability is fixed in 16.0.45 and 17.0.7.

CVSS Vector Analysis

Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

▪ Attack Vector (AV): Network

▪ Attack Complexity (AC): Low

▪ Attack Requirements (AT): None

▪ Privileges Required (PR): None

▪ User Interaction (UI): None

▪ Vulnerability Confidentiality Impact (VC): High

▪ Vulnerability Integrity Impact (VI): High

▪ Vulnerability Availability Impact (VA): None

▪ Subsequent Confidentiality Impact (SC): None

▪ Subsequent Integrity Impact (SI): None

▪ Subsequent Availability Impact (SA): None

Affected Vendors & Systems

Vendor FreePBX

References & Advisory Links

https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m55x-h47x-v3gx

Metadata Profile

Database Authority

European Union Agency for Cybersecurity (ENISA) EUVD

Assigner

GitHub_M

EPSS Probability

0.5

Known Aliases

CVE-2026-46376

Published On

2026-05-29

Last Updated

2026-09-28