# CVE-2026-46514: mwtcmi Frogman plaintext credential disclosure in audit logs

Source: https://junglewise.ai/threats/cve-2026-46514-mwtcmi-frogman-plaintext-credential-disclosure-in-audit-logs  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-46514 · Severity: medium · CVSS 6.5 · Published 2026-07-16

Frogman, a tool for managing PBX (Private Branch Exchange) phone systems, contains a vulnerability where sensitive credentials like passwords and device secrets are stored in plain text within system audit logs. Because the search tool for these logs was accessible to low-privileged users, an attacker with basic access could view these logs to steal administrative passwords or device credentials. This could lead to full unauthorized control over the phone system and its extensions.

Technologies: [Mwtcmi Frogman](https://junglewise.ai/threats/technologies/frogman). Vendors: [Mwtcmi](https://junglewise.ai/threats/vendors/mwtcmi).

## Quick answers

**Is CVE-2026-46514 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-46514 being exploited in the wild.

**How severe is CVE-2026-46514?** Medium severity, with a CVSS score of 6.5, published 16 July 2026.

**Which products and versions are affected?** Mwtcmi Frogman < 1.6.2.

**Is there a fix for CVE-2026-46514?** A patch was published on 2026-05-13: Version 1.6.1 released with security fixes; 1.6.2 released shortly after to fix installation regression Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-46514 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-46514?** Check whether you run Mwtcmi Frogman at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in Frogman's audit logging mechanism (specifically the auditOutcome function in Frogman.class.php) causes the application to JSON-encode and store full API responses in the 'oc_audit_log' table. Tools such as fm_reset_password and fm_add_extension return plaintext passwords and secrets in their response bodies, which are then persisted to the log. Furthermore, the fm_audit_search tool inherited a default PERM_READ permission level, allowing any authenticated user with low-level privileges to query the logs and extract these credentials. Version 1.6.2 fixes this by implementing a redaction filter for sensitive keys, increasing the required permission level for audit searches to PERM_ADMIN, and providing a script to scrub historical plaintext entries from the database.

## Affected products

- mwtcmi frogman < 1.6.2

## Timeline

- 2026-05-13: disclosed: Disclosed via FreePBX community forum
- 2026-05-13: patched: Version 1.6.1 released with security fixes; 1.6.2 released shortly after to fix installation regression
- 2026-07-16: advisory: NVD publication date

## References

- [https://github.com/mwtcmi/frogman/commit/02203edb613774f265ad8a21d99c4f6cf7de0d4d](https://github.com/mwtcmi/frogman/commit/02203edb613774f265ad8a21d99c4f6cf7de0d4d)
- [https://github.com/mwtcmi/frogman/releases/tag/v1.6.1](https://github.com/mwtcmi/frogman/releases/tag/v1.6.1)
- [https://github.com/mwtcmi/frogman/releases/tag/v1.6.2](https://github.com/mwtcmi/frogman/releases/tag/v1.6.2)
- [https://github.com/mwtcmi/frogman/security/advisories/GHSA-3p65-2prr-cfvf](https://github.com/mwtcmi/frogman/security/advisories/GHSA-3p65-2prr-cfvf)

## Related threats

- [mwtcmi Frogman stored XSS in chat console formatter](https://junglewise.ai/threats/cve-2026-46516-mwtcmi-frogman-stored-xss-in-chat-console-formatter)
- [mwtcmi Frogman missing authorization in multiple API tools](https://junglewise.ai/threats/cve-2026-46515-mwtcmi-frogman-missing-authorization-in-multiple-api-tools)
- [mwtcmi Frogman plaintext storage of API tokens](https://junglewise.ai/threats/cve-2026-46513-mwtcmi-frogman-plaintext-storage-of-api-tokens)
- [mwtcmi Frogman code injection in fm_dialplan_apply](https://junglewise.ai/threats/cve-2026-46512-mwtcmi-frogman-code-injection-in-fm-dialplan-apply)