FreePBX Endpoint Manager Flaws Enable Authentication Bypass and RCE Chain

FreePBX patched three serious vulnerabilities in the Endpoint Manager component that can be chained to give an attacker control of a vulnerable system. The issues include CVE-2025-66039, a critical authentication bypass tied to manipulation of the Authorization header to use the webserver authentication type, plus CVE-2025-61675 and **CVE-2025-61678`, two high-severity flaws that enable SQL injection and arbitrary file upload. Researchers reported that, when combined, the bugs can let an unauthenticated attacker read and modify SQL database contents and upload files such as webshells, leading to remote code execution.

The vulnerabilities affect FreePBX 16 before 16.0.44 and 16.0.92, and FreePBX 17 before 17.0.6 and 17.0.23. Reporting indicates the authentication bypass is not exploitable in a standard FreePBX configuration, but organizations with affected deployments were urged to update immediately and apply configuration mitigations where relevant. The disclosures highlight the risk of exposed PBX management components, particularly where Endpoint Manager is enabled and reachable by attackers.