dbcve.org
Missing AuthorizationWeakness · CWE-862

CVE-2026-46515

CRITICAL · 9.3 CVSS v4.0 Published 2026-07-16
Patch available
A vendor patch is available. No clean upgrade release — apply the published patch.
See remediation →
99/100
Remediation priority · Urgent
Remotely reachable Zero-click Patch available 5 weeks old

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.3, PERM_READ access was sufficient to call fm_list_managers, fm_list_pinsets, fm_show_context, fm_get_mcp_config, fm_backup_status, fm_whos_calling, fm_run_saved_query, and fm_diagnose_trunk, exposing AMI manager secrets, outbound dial PINs, full Asterisk dialplan context, root SSH connection commands, backup artifact paths, CDR history, arbitrary saved GraphQL query execution, and raw AMI endpoint dumps containing SIP fields such as password, md5_cred, and oauth_secret. This issue is fixed in version 1.6.3.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Frogman before 1.6.3 has an authorization bypass where PERM_READ (lowest privilege level) grants access to highly sensitive functions including fm_list_managers (exposes AMI secrets), fm_list_pinsets (outbound dial PINs), fm_show_context (full dialplan), fm_get_mcp_config (SSH root commands), fm_backup_status (artifact paths), and fm_diagnose_trunk (raw AMI endpoints with SIP credentials like passwords, md5_cred, oauth_secret). This allows any read-access user to obtain complete infrastructure compromise.

MitigationUpgrade to Frogman 1.6.3 immediately. Additionally, audit all PERM_READ user accounts and rotate any exposed secrets (AMI passwords, SSH keys, PINs, SIP credentials) since they may have been compromised.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
Low
Authentication
X
User interaction
None
Scope
X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Determine installed Frogman version
    Locate the Frogman installation directory and check the version file, binary, or package metadata. Common locations may include /opt/frogman, /usr/local/frogman, or the application directory. Look for a version file, --version flag, or check the application's about/status page.
    Affected if The installed version is prior to 1.6.3 (e.g., 1.6.2, 1.6.1, 1.6.0, or earlier)
  2. Identify users with PERM_READ-only access
    Examine the Frogman user database, configuration files, or administrative interface to list all users and their assigned permission levels. Look for users explicitly granted only PERM_READ role or permission set.
    Affected if There exist one or more users accounts configured with only PERM_READ permission level
  3. Verify sensitive function accessibility for low-privilege users
    Using a test account with only PERM_READ permissions, attempt to invoke each vulnerable function via the Frogman API or CLI: fm_list_managers, fm_list_pinsets, fm_show_context, fm_get_mcp_config, fm_backup_status, fm_whos_calling, fm_run_saved_query, fm_diagnose_trunk. Check if the calls succeed and return sensitive data.
    Affected if PERM_READ-only users can successfully invoke any of these sensitive administrative functions without authorization errors
  4. Inspect for exposed AMI manager secrets
    If the fm_list_managers function is accessible to low-privilege users, check the returned data for AMI manager credentials, API keys, or authentication secrets.
    Affected if AMI manager secrets, passwords, or authentication credentials are visible to PERM_READ-only users
  5. Inspect for exposed SIP credentials
    If any function returns SIP peer or endpoint configuration data, examine it for sensitive fields including password, md5_cred, and oauth_secret values.
    Affected if SIP credentials including plaintext passwords, md5 hashes, or OAuth secrets are exposed to users with only PERM_READ access

A user is affected if running Frogman version prior to 1.6.3 AND has users with only PERM_READ permission who can successfully invoke the sensitive administrative functions listed in the CVE, thereby exposing confidential configuration data.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Patch available Apply the vendor patch
Vendor patch github.com →
Interim mitigation

Upgrade to Frogman 1.6.3 immediately. Additionally, audit all PERM_READ user accounts and rotate any exposed secrets (AMI passwords, SSH keys, PINs, SIP credentials) since they may have been compromised.

Recommended fix High confidence

1.6.3

  1. Identify the current installed version of Frogman by checking the application or its configuration files
  2. Review the application's permission model and verify which users currently have PERM_READ access
  3. Plan a maintenance window for the upgrade process
  4. Upgrade Frogman to version 1.6.3 or later using the appropriate installation method (package manager, binary replacement, or source compilation)
  5. After upgrading, verify that the version is correctly installed
  6. Test that the previously vulnerable endpoints (fm_list_managers, fm_list_pinsets, fm_show_context, fm_get_mcp_config, fm_backup_status, fm_whos_calling, fm_run_saved_query, fm_diagnose_trunk) now require proper authorization beyond PERM_READ
  7. Verify that sensitive data (AMI secrets, PINs, SSH commands, SIP credentials) is no longer accessible with only PERM_READ access
  8. Update any automated scripts or integrations that rely on the previous permission model if needed

Generated from the published advisory — verify against the referenced sources before acting.

Have this fixed Scoped from the published advisory
  • Consultation4.0 h
  • Implementation4.0 h
  • Testing6.0 h
  • Review / QA2.0 h
16.0 hours of engineering $2,780
Get the patch applied

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $4,448.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-46515 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-46515 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data