CVE-2026-73661 in FreePBX
Summary
by MITRE • 08/14/2026
FreePBX is an open source IP PBX. Prior to 16.0.47 and 17.0.30, the FreePBX Framework module permits a crafted backup to restore the hidden AUTHTYPE setting with the value none through runRestore() in amp_conf/htdocs/admin/libraries/Builtin/Restore.php. An authenticated user with sufficient backup-restore access or write access to backup files can thereby disable FreePBX authentication during restoration, bypassing the user-interface removal of AUTHTYPE=none. This issue is fixed in versions 16.0.47 and 17.0.30.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
The vulnerability described represents a critical authentication bypass flaw in FreePBX versions prior to 16.0.47 and 17.0.30, where the framework module fails to properly validate backup restoration parameters. This issue occurs within the runRestore() function located in amp_conf/htdocs/admin/libraries/Builtin/Restore.php, which processes backup files during system restoration operations. The flaw allows an attacker to manipulate the AUTHTYPE setting by injecting the value "none" into backup files, effectively disabling authentication mechanisms during the restoration process.
The technical implementation of this vulnerability stems from insufficient input validation and parameter sanitization within the restore functionality. When a backup file is processed through runRestore(), the system does not adequately verify whether the AUTHTYPE parameter contains valid values or if it has been manipulated to bypass normal authentication procedures. This oversight creates an attack vector where an authenticated user with appropriate privileges can modify backup files to include malicious AUTHTYPE=none parameters, thereby circumventing the standard user interface protections that normally prevent such configuration changes.
The operational impact of this vulnerability is severe and potentially catastrophic for organizations relying on FreePBX for their communication infrastructure. An attacker who gains access to backup restoration capabilities or can write to backup file locations can completely disable authentication, allowing unauthorized access to the entire FreePBX administrative interface. This creates a persistent backdoor that remains active during system restoration operations, potentially enabling attackers to maintain long-term access while making legitimate system modifications appear as normal restoration activities.
This vulnerability aligns with CWE-285, which addresses improper authorization issues in software systems, and maps to ATT&CK technique T1078.004 for valid accounts and T1566.002 for spearphishing attachments, as it leverages legitimate backup restoration functionality to bypass security controls. The flaw also demonstrates characteristics of privilege escalation through configuration manipulation, similar to CWE-798 which deals with hardcoded credentials and improper access control mechanisms.
Organizations should immediately implement mitigation strategies including restricting write permissions to backup directories, implementing strict file integrity monitoring for backup files, and ensuring that only trusted administrators have access to backup restoration functionality. Additionally, administrators should verify that all FreePBX systems are updated to version 16.0.47 or 17.0.30 where this vulnerability has been patched. Network segmentation and monitoring of backup restoration activities should be implemented as additional defensive measures to detect potential exploitation attempts. The security community should also consider implementing automated checks for unauthorized modifications to authentication-related configuration parameters during system maintenance windows.