FreePBX Security Flaw Lets Attackers Access User Portals

Gbhackers •Divya • May 20, 2026

A critical security vulnerability has been discovered in FreePBX, a widely used open-source PBX platform, allowing unauthenticated attackers to access user portals under certain conditions. The flaw, tracked as CVE-2026-46376, carries a CVSS v4 base score of 9.1 and affects the User Control Panel (UCP) via the “userman” module. FreePBX Security Flaw According to an […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical FreePBX Vulnerability Exposes User Portals to Attackers A critical vulnerability in FreePBX, tracked as CVE-2026-46376, allows unauthenticated attackers to access user portals via the User Control Panel (UCP). This flaw arises from hard-coded credentials in the userman module and affects FreePBX versions prior to 16.0.45 and 17.0.7. Systems running outdated versions are particularly at risk. The vulnerability has a CVSS v4 base score of 9.1, indicating its severity. Administrators are urged to update their systems to mitigate the risk. The issue was disclosed on May 20, 2026, with no reports of active exploitation at this time. 3 sources 73

Extracted Entities

FreePBX Security Flaw Lets Attackers Access User Portals

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)