CVE-2025-59056 FreePBX vulnerable to unauthenticated Denial of Service

What is CVE-2025-59056?

CVE-2025-59056 is a medium-severity missing authorization vulnerability in Sangoma Freepbx, published on 15 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

FreePBX is an open-source web-based graphical user interface. In FreePBX 15, 16, and 17, malicious connections to the Administrator Control Panel web interface can cause the uninstall function to be triggered for certain modules. This function drops the module's database tables, which is where most modules store their configuration. This vulnerability is fixed in 15.0.38, 16.0.41, and 17.0.21.

Weakness: CWE-22

Which versions are affected by CVE-2025-59056?

It affects 1 product.

Products include Sangoma Freepbx.

How do I fix CVE-2025-59056?

No fix has been published for CVE-2025-59056 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-59056 being exploited?

There is no known exploitation of CVE-2025-59056 in the wild and no public exploit code.

Other vulnerabilities in Sangoma Freepbx

• CVE-2025-57819 Sangoma FreePBX Authentication Bypass Exploited Critical 10.0
• CVE-2019-19006 Sangoma FreePBX Improper Authentication Exploited Critical 9.8
• CVE-2026-73663 FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover Critical 9.3
• CVE-2026-73665 FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection Critical 9.3
• CVE-2026-46376 FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface Critical 9.3

All Sangoma Freepbx vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-frc2-jhgg-rwpr.