Is CVE-2026-46514 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46514 being exploited in the wild.

How severe is CVE-2026-46514?

Medium severity, with a CVSS score of 6.5, published 16 July 2026.

Is there a fix for CVE-2026-46514?

A patch was published on 2026-05-13: Version 1.6.1 released with security fixes; 1.6.2 released shortly after to fix installation regression Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46514 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-46514?

Check whether you run Mwtcmi Frogman at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46514: mwtcmi Frogman plaintext credential disclosure in audit logs

CVE-2026-46514 · Severity: medium · CVSS 6.5 · Published 2026-07-16

Frogman, a tool for managing PBX (Private Branch Exchange) phone systems, contains a vulnerability where sensitive credentials like passwords and device secrets are stored in plain text within system audit logs. Because the search tool for these logs was accessible to low-privileged users, an attacker with basic access could view these logs to steal administrative passwords or device credentials. This could lead to full unauthorized control over the phone system and its extensions.

Technologies: Mwtcmi Frogman. Vendors: Mwtcmi.

Quick answers

Is CVE-2026-46514 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46514 being exploited in the wild.
How severe is CVE-2026-46514?: Medium severity, with a CVSS score of 6.5, published 16 July 2026.
Which products and versions are affected?: Mwtcmi Frogman < 1.6.2.
Is there a fix for CVE-2026-46514?: A patch was published on 2026-05-13: Version 1.6.1 released with security fixes; 1.6.2 released shortly after to fix installation regression Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46514 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-46514?: Check whether you run Mwtcmi Frogman at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in Frogman's audit logging mechanism (specifically the auditOutcome function in Frogman.class.php) causes the application to JSON-encode and store full API responses in the 'oc_audit_log' table. Tools such as fm_reset_password and fm_add_extension return plaintext passwords and secrets in their response bodies, which are then persisted to the log. Furthermore, the fm_audit_search tool inherited a default PERM_READ permission level, allowing any authenticated user with low-level privileges to query the logs and extract these credentials. Version 1.6.2 fixes this by implementing a redaction filter for sensitive keys, increasing the required permission level for audit searches to PERM_ADMIN, and providing a script to scrub historical plaintext entries from the database.

Affected products

mwtcmi frogman < 1.6.2

Timeline

2026-05-13: disclosed: Disclosed via FreePBX community forum
2026-05-13: patched: Version 1.6.1 released with security fixes; 1.6.2 released shortly after to fix installation regression
2026-07-16: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.