Critical FreePBX Flaws Enable Unauthenticated RCE (UCP Socket.IO Auth Bypass) and SQL Injection Leading to Admin Takeover — Threadlinqs Intelligence
As of 2026-07-25, Critical FreePBX Flaws Enable Unauthenticated RCE (UCP Socket.IO Auth Bypass) and SQL Injection Leading to Admin Takeover is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 25 indicators of compromise.
Threat ID: TL-2026-1688 · Severity: CRITICAL · CVSS: 9.3 · Status: PATCHED · Category: VULNERABILITY
Two critical, unauthenticated FreePBX flaws let a remote attacker with no credentials compromise internet-facing PBX deployments: a socket.io namespace authentication-bypass in the User Control Panel
On 2026-07-16, FreePBX's security-reporting team published two critical advisories affecting Sangoma's FreePBX open-source PBX platform.
The first, GHSA-37j8-fhxx-9vhp, affects the FreePBX 17 User Control Panel (UCP) module prior to version 17.0.9. The UCP Node server listens on port 8001 (non-TLS) and port 8003 (TLS) and is designed to gate every socket.io connection with an `io.use(checkAuth)` middleware. A behavioral change in socket.io v4 altered how namespaces are handled — each namespace is now treated as its own independent channel — which caused the intended `checkAuth` authorization gate to no longer apply per-namespace. This lets an unauthenticated remote attacker open a raw socket.io connection to the UCP Node server and send crafted namespace events that are relayed into the Asterisk Manager Interface (AMI), resulting in arbitrary command execution with the privileges of the `asterisk` service account. The flaw is tracked as CWE-862 (Missing Authorization), carries a Red provider-urgency rating, and was reported by researcher mil1200, coordinated by chrsmj, analyzed by push143smart, with the fix engineered by Sangoma-Heera. Administrators can confirm patch status by inspecting the UCP login page HTML source for the `x-pjax-version` meta tag (patched builds show `v17.0.9`).
The second, GHSA-g27h-xf3q-h3rm, affects the FreePBX missedcall module — versions before 16.0.11 on FreePBX 16 and before 17.0.6 on FreePBX 17. The module performs an INSERT into the database every time a call to a monitored extension goes unanswered, and that INSERT concatenates the caller's inbound Caller ID Name (CNAM), taken directly from the SIP `From` header, straight into the SQL string with no escaping or parameterization (CWE-89). Because inbound SIP CNAM fields are not length-restricted the way legacy PSTN CNAM is, an attacker who can place a call to a monitored extension — via an open/anonymous SIP endpoint, a compromised SIP trunk, or direct internet calling — can inject a caller name containing SQL metacharacters that corrupts the database and rewrites administrator control-panel credentials, yielding full unauthorized access to the FreePBX Administrator Control Panel. FreePBX rated this issue Amber urgency (versus Red for the UCP flaw) because the missedcall module is not universally deployed, but the CVSS v4 base score is identical at 9.3, and the same reporter/coordinator pair (mil1200/chrsmj) is credited.
Neither advisory has an assigned CVE ID as of this writing (tracked only via their GHSA identifiers) and neither vendor nor independent researchers have reported confirmed in-the-wild exploitation, so this threat is classified DISCLOSED rather than ACTIVE. However, both bugs are remotely reachable pre-auth, require zero user interaction, and are chainable in principle — RCE via the UCP flaw could be used to further manipulate the same database the missedcall SQLi corrupts, and either flaw alone is sufficient for a full administrative compromise of an internet-facing FreePBX system. The FreePBX Community Forum thread on the missedcall SQLi (started 2026-07-16) also surfaced a public exploitability debate: community member James Finstrom initially argued the practical attack chain — requiring a crafted-CNAM call to go unanswered on a monitored extension — was so improbable it was like "playing your local lottery," before conceding real-world risk factors (stolen SIP credentials, unencrypted UDP exposure, SBC/firewall misconfiguration) could still make it exploitable.
FreePBX's own security-reporting bundle (surfaced the same week by the Canadian Centre for Cyber Security in advisory AV26-711) also shipped four additional, separately-tracked advisories in the same July 2026 release train, all requiring an existing authenticated FreePBX administrator account (unlike the two unauthenticated flaws documented here): GHSA-hg3v-m857-mvw9 (TTS module AGI command injection via the TTS destination name, tts < 16.0.6 on FreePBX 16 / < 17
Weaknesses (CWE)
CWE-862, CWE-89
Target sectors: telecoms, voip-providers, government administration, health, financial-services, hospitality, managed-service-providers, small-medium-business
Target regions: Global
Detections & IOCs
As of 2026-08-26, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 25 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, T1595, T1592, T1190, T1133, T1059, T1211, T1098, T1136, T1078, T1046
