Executive brief
FreePBX is an open-source telephone system (IP PBX) used by organizations to manage voice communications. A vulnerability in its backup and restore function allows an authenticated user with backup access to disable authentication entirely by restoring a specially crafted backup file, potentially giving an attacker complete control over the system without needing valid credentials.
Technical details
The vulnerability is an authentication bypass in the FreePBX Framework module's backup restore functionality (runRestore() in Restore.php). The flaw allows restoration of the AUTHTYPE configuration setting to "none", which disables authentication. An authenticated user with sufficient backup-restore access rights or write access to backup files can exploit this by crafting a malicious backup containing AUTHTYPE=none. The fix, applied in versions 16.0.47 and 17.0.30, explicitly filters out AUTHTYPE=none during restore operations, preventing the authentication bypass even if a crafted backup is processed.
Affected products
- FreePBX Framework prior to 16.0.47 and prior to 17.0.30
Timeline
- 2026-08-13: disclosed
- 2026: patched: Fixed in versions 16.0.47 and 17.0.30