CVE-2026-46515
Frogman: Multiple read-tier tools expose admin-grade data and arbitrary GraphQL execution
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.3, PERM_READ access was sufficient to call fm_list_managers, fm_list_pinsets, fm_show_context, fm_get_mcp_config, fm_backup_status, fm_whos_calling, fm_run_saved_query, and fm_diagnose_trunk, exposing AMI manager secrets, outbound dial PINs, full Asterisk dialplan context, root SSH connection commands, backup artifact paths, CDR history, arbitrary saved GraphQL query execution, and raw AMI endpoint dumps containing SIP fields such as password, md5_cred, and oauth_secret. This issue is fixed in version 1.6.3.
| CWE | CWE-862 |
| Vendor | mwtcmi |
| Product | frogman |
| Published | Jul 16, 2026 |
| Last Updated | Jul 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for mwtcmi frogman
Be the first to know when new unknown vulnerabilities affecting mwtcmi frogman are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
mwtcmi / frogman
< 1.6.3
References
github.com: https://github.com/mwtcmi/frogman/security/advisories/GHSA-q4c4-5cr4-8q47 github.com: https://github.com/mwtcmi/frogman/issues/13 github.com: https://github.com/mwtcmi/frogman/issues/25 github.com: https://github.com/mwtcmi/frogman/commit/55ea257d5c24bc01c814a607faa7e76e86b111ec github.com: https://github.com/mwtcmi/frogman/commit/b8a8bfc12b564bcb77caef952873b9ffd4a98b00 github.com: https://github.com/mwtcmi/frogman/releases/tag/v1.6.3