Is CVE-2026-46515 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46515 being exploited in the wild.

How severe is CVE-2026-46515?

Informational severity, with a CVSS score of 9.3, published 16 July 2026.

Is there a fix for CVE-2026-46515?

A patch was published on 2026-05-13: Version 1.6.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46515 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-46515?

Check whether you run Mwtcmi Frogman at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46515: mwtcmi Frogman missing authorization in multiple API tools

CVE-2026-46515 · Severity: info · CVSS 9.3 · Published 2026-07-16

Frogman, a tool used for managing PBX (Private Branch Exchange) phone systems, contained a security flaw where low-privileged users could access sensitive administrative information. An attacker with basic access could retrieve system passwords, call history, outbound dialing PINs, and root-level server connection commands. This could lead to full system takeover, unauthorized phone calls, or the theft of customer communication records.

Technologies: Mwtcmi Frogman. Vendors: Mwtcmi.

Quick answers

Is CVE-2026-46515 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46515 being exploited in the wild.
How severe is CVE-2026-46515?: Informational severity, with a CVSS score of 9.3, published 16 July 2026.
Which products and versions are affected?: Mwtcmi Frogman < 1.6.3.
Is there a fix for CVE-2026-46515?: A patch was published on 2026-05-13: Version 1.6.3 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46515 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-46515?: Check whether you run Mwtcmi Frogman at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization vulnerability (CWE-862) existed in Frogman's MCP and HTTP API where eight sensitive tools inherited a default 'PERM_READ' permission level instead of requiring administrative access. Authenticated attackers with low-tier permissions could invoke functions such as 'fm_list_managers' and 'fm_diagnose_trunk' to extract Asterisk Manager Interface (AMI) secrets, SIP trunk passwords, plaintext dial PINs, and full dialplans. Additionally, 'fm_get_mcp_config' exposed root SSH connection strings, and 'fm_run_saved_query' allowed execution of arbitrary GraphQL queries. The vulnerability is resolved in version 1.6.3 by elevating these tools to 'PERM_ADMIN' and implementing line-level redaction for sensitive fields in diagnostic outputs.

Affected products

mwtcmi Frogman < 1.6.3

Timeline

2026-05-13: patched: Version 1.6.3 released
2026-07-16: disclosed: CVE-2026-46515 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.