FreePBX up to 16.0.46/17.0.29 Framework Restore.php runRestore improper authentication

Summaryinfo

A vulnerability, which was classified as problematic, has been found in FreePBX up to 16.0.46/17.0.29. The affected element is the function runRestore of the file amp_conf/htdocs/admin/libraries/Builtin/Restore.php of the component Framework Module. Performing a manipulation results in improper authentication. This vulnerability is identified as CVE-2026-73661. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, was found in FreePBX up to 16.0.46/17.0.29. This affects the function runRestore of the file amp_conf/htdocs/admin/libraries/Builtin/Restore.php of the component Framework Module. The manipulation with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

FreePBX is an open source IP PBX. Prior to 16.0.47 and 17.0.30, the FreePBX Framework module permits a crafted backup to restore the hidden AUTHTYPE setting with the value none through runRestore() in amp_conf/htdocs/admin/libraries/Builtin/Restore.php. An authenticated user with sufficient backup-restore access or write access to backup files can thereby disable FreePBX authentication during restoration, bypassing the user-interface removal of AUTHTYPE=none. This issue is fixed in versions 16.0.47 and 17.0.30.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-73661 since 08/13/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. The exploitation needs additional levels of successful authentication. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

By approaching the search of inurl:amp_conf/htdocs/admin/libraries/Builtin/Restore.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 16.0.47 or 17.0.30 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• FreePBX

Version

• 16.0.0
• 16.0.1
• 16.0.2
• 16.0.3
• 16.0.4
• 16.0.5
• 16.0.6
• 16.0.7
• 16.0.8
• 16.0.9
• 16.0.10
• 16.0.11
• 16.0.12
• 16.0.13
• 16.0.14
• 16.0.15
• 16.0.16
• 16.0.17
• 16.0.18
• 16.0.19
• 16.0.20
• 16.0.21
• 16.0.22
• 16.0.23
• 16.0.24
• 16.0.25
• 16.0.26
• 16.0.27
• 16.0.28
• 16.0.29
• 16.0.30
• 16.0.31
• 16.0.32
• 16.0.33
• 16.0.34
• 16.0.35
• 16.0.36
• 16.0.37
• 16.0.38
• 16.0.39
• 16.0.40
• 16.0.41
• 16.0.42
• 16.0.43
• 16.0.44
• 16.0.45
• 16.0.46
• 17.0.0
• 17.0.1
• 17.0.2
• 17.0.3
• 17.0.4
• 17.0.5
• 17.0.6
• 17.0.7
• 17.0.8
• 17.0.9
• 17.0.10
• 17.0.11
• 17.0.12
• 17.0.13
• 17.0.14
• 17.0.15
• 17.0.16
• 17.0.17
• 17.0.18
• 17.0.19
• 17.0.20
• 17.0.21
• 17.0.22
• 17.0.23
• 17.0.24
• 17.0.25
• 17.0.26
• 17.0.27
• 17.0.28
• 17.0.29

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion