CVE-2026-72578

HIGH 8.8

FreePBX Framework - Missing CSRF Protection in Admin Panel Ajax Dispatcher

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

A cross-site request forgery (CSRF) vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator.

CWE	CWE-352
Vendor	freepbx
Product	freepbx framework
Published	Aug 10, 2026
Last Updated	Aug 10, 2026

Stay Ahead of the Next One

Get instant alerts for freepbx freepbx framework

Be the first to know when new high vulnerabilities affecting freepbx freepbx framework are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

FreePBX / FreePBX Framework

17.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/FreePBX/framework github.com: https://github.com/FreePBX/framework/blob/release/17.0/amp_conf/htdocs/admin/libraries/BMO/Ajax.class.php

Credits

Adrian Gaitan