CVE-2026-46376 is a hard-coded credentials flaw in the FreePBX User Control Panel (UCP), rated CVSS 9.8 (critical). Unauthenticated users may log in with initial template credentials if the administrator did not change them. It is fixed in userman 16.0.45 and 17.0.7, so update those modules.
What's affected
The NVD record says the issue affects FreePBX from 15.0.42 up to before 16.0.45 and 17.0.7. The GitHub advisory frames the fix by module: the userman module for FreePBX 16 before 16.0.45, and for FreePBX 17 before 17.0.7.
The exposure arises when an administrator enables UCP generic templates. Authenticated access to the Administrator Control Panel is needed for that initial setup. After that, without further steps by the admin, unauthenticated users may be able to get in using the template credentials.
Fixed versions: 16.0.45 and 17.0.7.
How to check if you're exposed
- In the FreePBX admin, open the module list and note the User Management (userman) version.
- Compare it with 16.0.45 for FreePBX 16 or 17.0.7 for FreePBX 17.
- Check whether UCP generic templates were ever enabled and whether the template credentials were changed.
- Check whether UCP is reachable from the internet or other untrusted networks.
What to do now
- Update the userman module to the fixed version. The advisory says the update randomizes the password.
- Limit the Administrator Control Panel to authorized users, for example through FreePBX User Management, a SysAdmin VPN, MFA or SAML.
- Block ACP and UCP access from untrusted networks, for example with the FreePBX Firewall module. The advisory notes it can limit UCP access to IPs that have registered SIP phones.
- Review UCP accounts and recent logins for anything unexpected.
Why it matters
The weakness is CWE-798, use of hard-coded credentials. A shared default is a known password. If a setup step leaves it in place, anyone who knows or guesses it has the same access as a legitimate user.
A phone system also holds call routing, voicemail and user settings, so the control panel is a sensitive door. The record's KEV flag is false.
Quick check
Is the fix only a version bump?
According to the advisory, upgrading userman is the fix and it randomizes the password. It also suggests restricting network access to the panels as an extra layer.
Sources
Last reviewed: 19 October 2026.
