EUVD-2026-44999Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
PR:L confirmed by PERM_READ requirement; C:H for full credential disclosure; I:N and A:N as exploitation is read-only log access.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_reset_password in Tools/ResetPassword.php:48-53 returned a plaintext password and fm_add_extension in Tools/AddExtension.php:172 returned a plaintext secret; Frogman.class.php:2207-2211 used auditOutcome to JSON-encode those responses into oc_audit_log.detail, allowing any PERM_READ caller with access to fm_audit_search to recover the stored credentials. This issue is fixed in version 1.6.2.
AnalysisAI
Plaintext credential exposure in Frogman's audit logging pipeline allows any authenticated low-privilege user holding PERM_READ access to recover passwords and extension secrets set by administrative operations. Frogman versions prior to 1.6.2 encode full tool response payloads - including the plaintext password returned by fm_reset_password and the plaintext secret returned by fm_add_extension - directly into the oc_audit_log.detail column via auditOutcome in Frogman.class.php. Because fm_audit_search was gated only at PERM_READ rather than PERM_ADMIN, any read-tier caller could query historical audit entries and extract those credentials. No public exploit code or active exploitation has been identified at time of analysis; the CVSS score of 6.5 reflects the authenticated-but-low-privilege access requirement and high confidentiality impact.
Technical ContextAI
Frogman is a PHP-based headless PBX control module exposing management functions via an MCP tool interface and HTTP API, built on top of FreePBX (identified through the FreePBX::Database() call in install.php). The root cause is CWE-532: Insertion of Sensitive Information into Log File. Specifically, the auditOutcome method in Frogman.class.php passed entire tool response arrays directly to json_encode() before writing them to the oc_audit_log.detail column, without any key-based redaction. This meant that whenever fm_reset_password completed (returning a new plaintext password field) or fm_add_extension completed (returning a plaintext secret field), those values were persisted verbatim in the database audit table. The affected CPE is cpe:2.3:a:mwtcmi:frogman:*:*:*:*:*:*:*:*, indicating all versions of Frogman prior to 1.6.2. Compounding the exposure, fm_audit_search - the tool that queries oc_audit_log - was previously gated at PERM_READ rather than PERM_ADMIN, meaning the credential extraction required only the minimum tier of authenticated access.
RemediationAI
The primary fix is to upgrade Frogman to version 1.6.2, which introduces the redactSensitive() method in Frogman.class.php to strip known credential keys (password, secret, token, vmpwd, umpassword, umpwd, api_key, apikey) from audit log writes, and simultaneously elevates the fm_audit_search permission gate from PERM_READ to PERM_ADMIN in AuditSearch.php. The patch is available at https://github.com/mwtcmi/frogman/releases/tag/v1.6.2 and the underlying commit at https://github.com/mwtcmi/frogman/commit/02203edb613774f265ad8a21d99c4f6cf7de0d4d. Critically, upgrading also executes a one-shot migration via install.php that scrubs plaintext credential values from all historical oc_audit_log entries - administrators must confirm this migration completes successfully, as it processes rows in batches of 500 and logs a count of redacted entries; a migration failure leaves historical credentials exposed. If an immediate upgrade is not possible, the most effective compensating control is to manually update the permissionLevel() return value in Tools/AuditSearch.php from PERM_READ to PERM_ADMIN, preventing read-tier accounts from querying audit logs; this does not redact already-stored plaintext values, so a subsequent database-level scrub of the oc_audit_log.detail and oc_audit_log.params columns for keys matching the sensitive key list is also advisable. Restricting network access to the Frogman API to trusted management hosts reduces exposure but does not eliminate the risk for multi-tenant or multi-role deployments.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today