Executive brief
Frogman, a tool used for managing PBX (Private Branch Exchange) phone systems, contained a security flaw where low-privileged users could access sensitive administrative information. An attacker with basic access could retrieve system passwords, call history, outbound dialing PINs, and root-level server connection commands. This could lead to full system takeover, unauthorized phone calls, or the theft of customer communication records.
Technical details
A missing authorization vulnerability (CWE-862) existed in Frogman's MCP and HTTP API where eight sensitive tools inherited a default 'PERM_READ' permission level instead of requiring administrative access. Authenticated attackers with low-tier permissions could invoke functions such as 'fm_list_managers' and 'fm_diagnose_trunk' to extract Asterisk Manager Interface (AMI) secrets, SIP trunk passwords, plaintext dial PINs, and full dialplans. Additionally, 'fm_get_mcp_config' exposed root SSH connection strings, and 'fm_run_saved_query' allowed execution of arbitrary GraphQL queries. The vulnerability is resolved in version 1.6.3 by elevating these tools to 'PERM_ADMIN' and implementing line-level redaction for sensitive fields in diagnostic outputs.
Affected products
- mwtcmi Frogman < 1.6.3
Timeline
- 2026-05-13: patched: Version 1.6.3 released
- 2026-07-16: disclosed: CVE-2026-46515 published
References
- https://github.com/mwtcmi/frogman/commit/55ea257d5c24bc01c814a607faa7e76e86b111ec
- https://github.com/mwtcmi/frogman/commit/b8a8bfc12b564bcb77caef952873b9ffd4a98b00
- https://github.com/mwtcmi/frogman/issues/13
- https://github.com/mwtcmi/frogman/issues/25
- https://github.com/mwtcmi/frogman/releases/tag/v1.6.3
- https://github.com/mwtcmi/frogman/security/advisories/GHSA-q4c4-5cr4-8q47