FreePBX is an open source IP PBX. Prior to 16.0.47 and 17.0.30, the FreePBX Framework module permits a crafted backup to restore the hidden AUTHTYPE setting with the value none through runRestore() in amp_conf/htdocs/admin/libraries/Builtin/Restore.php. An authenticated user with sufficient backup-restore access or write access to backup files can thereby disable FreePBX authentication during restoration, bypassing the user-interface removal of AUTHTYPE=none. This issue is fixed in versions 16.0.47 and 17.0.30.
{
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-15"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73661.json"
}{
"extracted_events": [
{
"cpe": "cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "16.0"
},
{
"fixed": "16.0.47"
}
],
"source": "CPE_RANGE"
}
]
}
{
"extracted_events": [
{
"cpe": "cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "16.0"
},
{
"fixed": "16.0.47"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:sangoma:freepbx:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "17.0"
},
{
"fixed": "17.0.30"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "0591581654bc269df05cbb7093645d6934d4d861"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "ea684be89abb393d1aff7f979d5fd751ff338dfd"
}
],
"source": "REFERENCES_COMMIT"
}
]
}