---
id: "CVE-2019-19006"
kind: "vulnerability"
aliases: ["CVE-2019-19006"]
title: "Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Sangoma FreePBX", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "sangoma freepbx", "fixed": [], "affected": ">= 13.0.0.0, <= 13.0.197.13", "ecosystem": "vendor"}, {"name": "sangoma freepbx", "fixed": [], "affected": ">= 14.0.0.0, <= 14.0.13.11", "ecosystem": "vendor"}, {"name": "sangoma freepbx", "fixed": [], "affected": ">= 15.0.0.0, <= 15.0.16.26", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["asterisk", "exploited", "freepbx", "infrastructure", "self-hosted", "voip"]
not_affected_if: ["managed-hosting", "not-using-freepbx"]
published_at: "2019-11-21T18:15:11+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T23:44:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-19006", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19006", "first_seen_at": "2026-10-23T23:44:51+00:00"}]
---

# Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control

Sangoma FreePBX, a web admin panel for phone systems, has an authentication flaw that can let unauthenticated users bypass the password check. An attacker who gets past login can reach services exposed by the FreePBX admin, which the sources do not detail further.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Sangoma FreePBX affected ? fixed ?
- vendor:sangoma freepbx affected >= 13.0.0.0, <= 13.0.197.13 fixed ?
- vendor:sangoma freepbx affected >= 14.0.0.0, <= 14.0.13.11 fixed ?
- vendor:sangoma freepbx affected >= 15.0.0.0, <= 15.0.16.26 fixed ?

## Fix

Apply vendor mitigations per Sangoma guidance; the sources do not name a fixed version.
If no mitigation exists, discontinue use of the product per CISA guidance.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-19006
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-19006

## From the sources

Sangoma FreePBX contains an improper authentication vulnerability that potentially allows unauthorized users to bypass password authentication and access services provided by the FreePBX admin.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_