External risk intelligence

Frogman PBX Information Disclosure Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-46515

Frogman provides a headless PBX control interface via HTTP API. These types of management APIs and PBX control services are commonly deployed as web-accessible or network-reachable services to allow for remote configuration, integration, and management of telephony systems.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects Frogman, a system for controlling PBX (Private Branch Exchange) systems remotely. If unpatched, it could expose sensitive information such as system credentials, configuration details, and user call history to unauthorized individuals who gain limited access. The primary concern is to confirm if this technology is in use and whether it is exposed to potential threats.

Unauthenticated access could expose sensitive PBX data.
Vital for understanding potential exposure of communication systems.
Confirm relevance and scope of this system's use.

Attack Path

How an attacker could exploit the issue

An attacker with read access to Frogman could exploit this vulnerability by interacting with its HTTP API to expose sensitive information. This includes details like AMI manager secrets, outbound dial PINs, and full Asterisk dialplan contexts, potentially leading to further compromise of the PBX system.

Requires read access to the system.
Calls specific API functions to trigger.
Exposes sensitive system credentials and configuration.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an authenticated user with read permissions could access sensitive configuration details and operational data from the Frogman PBX control system. This could include internal secrets, dial plan configurations, command execution capabilities, and detailed call history.

AMI manager secrets and PINs could be exposed.
Read-privileged access could lead to information disclosure.
Sensitive operational data may be revealed.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Frogman PBX control application's API is likely managed by the application owner or a dedicated platform team, as it facilitates critical telephony functions. The immediate first step is to locate all instances of Frogman, assess their reachability and business criticality, and identify the accountable system owner to plan remediation efforts.

Application owners and platform teams.
Verify Frogman instances and their exposure.
Plan remediation based on asset criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Frogman and how is it used?

Frogman is a headless control interface for Private Branch Exchange (PBX) systems. It provides an HTTP API and Message Control Protocol (MCP) to manage telephony configurations remotely. Organizations use it to centralize administrative tasks like dialplan management, trunk diagnostics, and system monitoring for their communication infrastructure.

What kind of security weakness is CVE-2026-46515?

This vulnerability is classified as CWE-862, which is a Missing Authorization weakness. In the context of CVE-2026-46515, the application fails to verify if a user has the appropriate permission level before executing sensitive API functions. Consequently, users with basic read-only access can trigger commands that should be restricted, resulting in the unauthorized disclosure of administrative secrets, dialplan logic, and system credentials.

How can an attacker trigger this vulnerability?

An attacker must have existing read-level access to the Frogman API to trigger this flaw. By calling specific functions—such as those used for listing managers or diagnosing trunks—the user can extract restricted configuration data. The bug is not triggered by users lacking any form of authentication, as a baseline level of API access is a necessary precondition for the unauthorized function calls to succeed.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates that Frogman instances are frequently deployed as network-reachable services to support remote telephony management. Because these APIs are often exposed to allow for external integrations, they are more likely to be reachable by unauthorized parties. You should verify your environment's network configuration to determine if your specific instance is accessible beyond internal boundaries.

What is the first step to address CVE-2026-46515?

The most effective first step is to upgrade your Frogman installation to version 1.6.3, which contains the official fix. Before patching, conduct an inventory to locate all active Frogman instances in your environment and identify the team responsible for their operation. Prioritize these updates by assessing which systems handle the most sensitive telephony traffic or are most exposed to your network's perimeter.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.