CVE-2026-73663 is a critical (CVSS 9.8) SQL injection in the FreePBX missedcall module. The caller name from a crafted SIP From header goes into a database query unescaped. Update the missedcall module, and accept inbound calls only from trusted trunks.
What's affected
The FreePBX missedcall module. The NVD record says FreePBX 16.0.0 until 16.0.11 and 17.0.4. The FreePBX security advisory lists the module as affected below 16.0.11 on FreePBX 16 and below 17.0.6 on FreePBX 17, with those as the fixed versions. The two sources differ for FreePBX 17, so use the higher figure and take the module version from the advisory.
The advisory says most installations do not use this module, and that it sets the provider urgency to Amber for those who do. The issue is reached when a call to a monitored extension goes unanswered, so it needs the module active and a monitored extension.
How to check if you're exposed
List the module and its version from the FreePBX command line.
fwconsole ma list | grep -i missedcall
If the module is not installed or not enabled, this path is not in use. If it is, compare its version with the fixed versions above. Also look at how inbound calls reach your system. A PBX that accepts anonymous calls from the internet is the most exposed, according to the advisory.
What to do now
- Check whether the missedcall module is installed and enabled.
- Update the module to 16.0.11 on FreePBX 16 or 17.0.6 on FreePBX 17, or later.
- Allow inbound SIP only from known, trusted trunks and endpoints.
- Limit access to the FreePBX administrator control panel.
- Review administrator accounts for ones you did not create, since the advisory says a successful injection can change them.
Why it matters
The record maps this to CWE-89, SQL injection. The module ran an INSERT each time a monitored call went unanswered, and put the caller's name straight into the SQL text. A name is something the caller controls. Without escaping or bound parameters, text in the name can change the meaning of the query.
The advisory points out a useful detail. Public phone networks limit the caller name field to 15 characters, which limits what can be sent. But this issue makes all third party caller names suspect, and callers who reach the system through SIP can set their own header text.
The fix pattern is old and reliable: pass values as bound parameters. Data that arrives over a telephony protocol deserves the same suspicion as a web form. The KEV flag is false.
Hardening the telephony edge
SIP is chatty and open by design, and any text field a caller sets can reach your logs and databases. After updating, review who can send calls to the system. Restrict SIP signalling to known trunk providers by address, and keep the web administration interface reachable only from management networks. FreePBX's firewall module can help here, and the advisory's own mitigation list recommends limiting inbound calls to trusted trunks.
Checking for tampering
The advisory warns that a successful injection can change administrator accounts. Review the list of administrator users and the associated settings, and look for accounts you did not create. Check the database for unexpected rows in the missed call log table. If anything looks wrong, rotate administrator passwords and review the system as you would after any suspected access.
The free in-browser dependency scan at gold.safeguard.sh/scan can show whether a project you maintain pulls in an affected package, and the Gold vulnerability directory keeps the record for this CVE.
Quick check
Is this the same as CVE-2026-73665?
No. Both affect FreePBX, but this one is SQL injection in the missedcall module and the other is an authentication gap in the UCP Node server.
Sources
Last reviewed: 19 October 2026.
