FreePBX Framework CVE-2026-73661

Exploitation requires an existing authenticated FreePBX account with Backup & Restore module access, or filesystem-level write access to the backup archive storage directory - this is a non-default elevated privilege, not available to standard users. The attacker must also be able to trigger a restore operation through the FreePBX administrative interface. What limits exploitation: purely unauthenticated remote attackers cannot exploit this vulnerability without first obtaining credentials; the PR:L requirement is a meaningful but not prohibitive barrier in environments with multiple admin-level users. The vulnerability does not affect deployments where the Backup & Restore module is disabled or its access is strictly limited to a single trusted administrator. Post-exploitation impact (universal unauthenticated access) is however unbounded once the condition is triggered.

The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) accurately reflects the two-stage risk structure: exploitation is straightforward (low complexity, no special attack requirements) for anyone holding a FreePBX account with backup-restore access, but that account requirement (PR:L) is the meaningful friction point. The immediate impact is severe - disabling authentication opens the entire admin panel to any network-reachable user. No EPSS data was provided and no CISA KEV listing exists, so widespread active exploitation is unconfirmed. However, the attack technique is fully derivable from the public fix commit, and FreePBX deployments are common in environments that may have multiple internal users with backup module access. The real-world risk is elevated in multi-tenant or MSP-managed FreePBX deployments where backup privileges are distributed to non-admin users. CVSS correctly reflects no availability impact (VA:N) - the telephony service continues running, only authentication is subverted. No conflicting signals: network vector, low complexity, and low privilege are all consistent with the description.

An authenticated FreePBX user with backup-restore module access crafts a backup archive that includes a configuration entry setting AUTHTYPE=none, then triggers a restore via the administrative web interface. The runRestore() function on unpatched versions processes the setting without filtering and writes it to the system configuration. From that point forward, any network-reachable user - including external attackers - can access the FreePBX admin panel without any credentials, enabling full PBX reconfiguration, toll fraud, voicemail access, and call interception.