CVE-2026-73661

CVE-2026-73661 is a trust boundary violation where FreePBX's restore function accepts configuration that the UI actively prevents. Specifically, the AUTHTYPE parameter can be set to "none" during a restore operation, disabling authentication entirely — a setting the UI deliberately removes from user visibility. This isn't a simple oversight; it reflects a deeper architectural split where the interface was hardened after the danger was recognized, but the restore path continued operating on raw configuration state as if nothing changed. The exploitability window is wider than the 'authenticated user' framing suggests. The restore function accepts configuration from backup files, and in many FreePBX deployments these files are stored with permissions that exceed those of the web application itself. Backup files may flow through third-party systems, email attachments, network storage, or scheduled jobs running as root. You don't necessarily need web application credentials — you need write access to a backup file that gets fed to the restore endpoint. Audit who can write to your backup storage, not just who can log into FreePBX. Treat this as a pattern, not an isolated flaw. The restore function has no concept of 'hidden' or 'deprecated' settings — it faithfully reconstructs whatever configuration exists in the backup, including settings the UI suppressed. Check whether other restricted parameters can survive a restore operation. The fix in 16.0.47 and 17.0.30 addresses this specific parameter, but the underlying architectural assumption — that restore can bypass UI-layer restrictions — may surface again with other settings. After any restore operation, treat it as a potential authentication integrity failure: invalidate sessions, rotate credentials, and audit the resulting system state.

Reviewed through automated stages and approved by a human before publication.