CVE-2019-19006 Sangoma FreePBX Improper Authentication
Attackers can bypass authentication controls in FreePBX, potentially gaining unauthorized access to the system.
- Exploited in the wild
- Since 3 Feb 2026
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-19006?
CVE-2019-19006 is a critical authentication bypass vulnerability in Sangoma Freepbx, published on 21 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.
Weakness: CWE-287
Which versions are affected by CVE-2019-19006?
It affects 1 product.
Products include Sangoma Freepbx.
How do I fix CVE-2019-19006?
No fix has been published for CVE-2019-19006 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 24 Feb 2026.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-19006 being exploited?
Yes. Attackers have exploited CVE-2019-19006 in the wild since at least 3 Feb 2026.
Other vulnerabilities in Sangoma Freepbx
- CVE-2025-57819 Sangoma FreePBX Authentication Bypass
- CVE-2026-73663 FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover
- CVE-2026-73665 FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection
- CVE-2026-46376 FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface
- CVE-2025-66039 FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header
Sources
Also known as GHSA-85h5-chmw-697j.