FreePBX Vulnerability Allow Attackers to Gain Access to User Portals

Cybersecuritynews •Abinaya • May 20, 2026

A critical vulnerability in the open-source IP PBX platform FreePBX could allow unauthenticated attackers to access user portals. The issue, tracked as CVE-2026-46376, affects the User Control Panel (UCP) interface due to hard-coded credentials in the userman module. It impacts FreePBX versions before 16.0.45 and 17.0.7. Systems running outdated versions are at risk if administrators […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical FreePBX Vulnerability Exposes User Portals to Attackers A critical vulnerability in FreePBX, tracked as CVE-2026-46376, allows unauthenticated attackers to access user portals via the User Control Panel (UCP). This flaw arises from hard-coded credentials in the userman module and affects FreePBX versions prior to 16.0.45 and 17.0.7. Systems running outdated versions are particularly at risk. The vulnerability has a CVSS v4 base score of 9.1, indicating its severity. Administrators are urged to update their systems to mitigate the risk. The issue was disclosed on May 20, 2026, with no reports of active exploitation at this time. 3 sources 73

Extracted Entities

FreePBX Vulnerability Allow Attackers to Gain Access to User Portals

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (1)