CVE-2026-73661 FreePBX CVE debrief

Who should care

Defenders responsible for FreePBX systems, particularly those with backup-restore access or write access to backup files, should assess exposure and verify the integrity of their backup files to prevent potential authentication bypass during restoration. Prioritization should be given to verifying and restricting backup-restore access and ensuring backup file integrity.

Why it matters

CVE-2026-73661 allows an authenticated user with sufficient backup-restore access or write access to backup files to disable FreePBX authentication during restoration. Defenders should prioritize verifying and restricting backup-restore access and ensuring the integrity of backup files.

• Authentication bypass during restoration
• Potential for unauthorized access
• Need for verification of backup-restore access controls
• Importance of ensuring backup file integrity

Technical summary

The FreePBX Framework module permits a crafted backup to restore the hidden AUTHTYPE setting with the value none through runRestore() in amp_conf/htdocs/admin/libraries/Builtin/Restore.php. This allows an authenticated user with sufficient backup-restore access or write access to backup files to disable FreePBX authentication during restoration. The issue is fixed in versions 16.0.47 and 17.0.30. Defenders should prioritize verifying and restricting backup-restore access and ensuring the integrity of backup files to mitigate potential authentication bypass.

Defensive priority

Defenders should prioritize verifying and restricting backup-restore access and ensuring the integrity of backup files.

Recommended defensive actions

• Verify and restrict backup-restore access
• Ensure integrity of backup files
• Monitor for suspicious backup restoration activity
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions, retest remediated assets
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The FreePBX Framework module permits a crafted backup to restore the hidden AUTHTYPE setting with the value none through runRestore() in amp_conf/htdocs/admin/libraries/Builtin/Restore.php. This functionality can be exploited by an authenticated user with sufficient backup-restore access or write access to backup files, potentially leading to authentication bypass during restoration. Defenders should verify the integrity of backup files and restrict backup-restore access.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.