FreePBX Framework CVE-2026-72578

The target administrator must hold an active authenticated FreePBX session (valid session cookie) at the moment the forged request is submitted - exploitation is limited to the window during which an admin is logged in. The attacker must successfully deliver and have the administrator interact with a malicious web page (phishing, watering-hole, or malicious advertisement). The Referer bypass specifically requires that the forged request either omits the Referer header entirely (achievable via <form> submissions or fetch() with referrerPolicy: 'no-referrer') or originates from a same-site context. No special non-default FreePBX configuration is required - the missing CSRF token validation is present in the default FreePBX Framework 17.0 installation for all administrative AJAX calls routed through /admin/ajax.php. Exploitation is constrained by the UI:R requirement: passive network positioning or direct server access is insufficient; the attacker must induce the specific admin user interaction.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately characterises the attack profile: network-reachable, low complexity, no attacker credentials required, one user interaction needed (admin visits a malicious page), and full C/I/A impact within the application scope. The high impact ratings are justified given that admin control over a FreePBX deployment translates directly into call interception, dial plan manipulation, SIP trunk reconfiguration, and potential pivot to the underlying Asterisk system. No EPSS data was provided, and the absence of a CISA KEV listing means active exploitation is not confirmed; however, even a mid-sized municipal IT team in koszalin should treat this as urgent because FreePBX admin panels are frequently LAN-exposed or internet-facing, and the social-engineering barrier to triggering a CSRF is low - a convincing phishing email to an admin is sufficient. The missing CSRF token is a design-level gap in the default installation, not a configuration-dependent condition, meaning every FreePBX Framework 17.0 deployment is vulnerable by default during any active admin session. No conflicting signals exist between the description and CVSS vector.

An attacker identifies a FreePBX 17.0 deployment and crafts a malicious web page containing hidden HTML forms or JavaScript fetch() calls with referrerPolicy: 'no-referrer' targeting the victim organisation's /admin/ajax.php endpoint. The attacker sends a phishing email to a FreePBX administrator who is currently logged into the panel; upon visiting the malicious page, the admin's browser silently submits the forged request - carrying the legitimate session cookie - causing FreePBX to execute the attacker-chosen administrative action, such as adding a rogue SIP trunk, creating a backdoor admin account, or modifying call routing rules. No public exploit code has been identified at time of analysis, but the attack is trivially constructable from public source code and standard CSRF techniques.