CVE-2026-72578

Name of the Vulnerable Software and Affected Versions FreePBX Framework version 17.0

Description A cross-site request forgery (CSRF) issue allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator. The '/admin/ajax.php' endpoint in amp conf/htdocs/admin/libraries/BMO/Ajax.class.php fails to implement CSRF tokens. The existing protection relies solely on a Referer header check, which can be bypassed if the request is sent without a Referer header or from a same-site context. This enables attackers to trigger administrative operations by luring an administrator to a malicious page.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.