Security readout for executives and security teams
Plain-English summary
Frogman before 1.6.3 allowed users with read-only permission to retrieve highly sensitive PBX administration data. That could expose call records, manager secrets, dialing PINs, dialplan details, backup paths, and connection information. The vulnerability is fixed in 1.6.3, and the bundle does not show active exploitation.
Executive priority
Treat this as an urgent patch and credential-review item for any Frogman-managed PBX environment. The business concern is sensitive telephony administration data exposure, not confirmed mass exploitation.
Technical view
This is an authorization failure in Frogman’s MCP and HTTP API. PERM_READ could access multiple tools that returned admin-grade data or executed saved GraphQL queries. Affected versions are mwtcmi frogman before 1.6.3. The CVSS 4.0 score is 9.3 and CWE-862 is listed.
Likely exposure
Exposure is most likely in organizations running Frogman below 1.6.3 with MCP or HTTP API users assigned PERM_READ. PBX environments with stored AMI, SIP, OAuth, SSH, dial PIN, CDR, backup, or dialplan data are the relevant scope.
Exploitation context
The source bundle supports low-privilege authenticated misuse, not unauthenticated exploitation. KEV is false, and no cited source states active exploitation. The risk is still severe because read-tier access could reveal secrets and operational PBX data.
Researcher notes
The advisory names fm_list_managers, fm_list_pinsets, fm_show_context, fm_get_mcp_config, fm_backup_status, fm_whos_calling, fm_run_saved_query, and fm_diagnose_trunk. Evidence indicates an authorization boundary failure fixed in 1.6.3; exploit availability is not established in the supplied sources.
Mitigation direction
- Upgrade Frogman to version 1.6.3 or later.
- Review the GitHub advisory and release notes for vendor guidance.
- Restrict MCP and HTTP API access to trusted users and networks.
- Audit PERM_READ accounts and remove unnecessary access.
- Rotate exposed AMI, SIP, OAuth, SSH, and dialing secrets if access is suspected.
Validation and detection
- Inventory Frogman deployments and confirm installed versions.
- Review accounts or tokens with PERM_READ access.
- Check logs for use of the affected read-tier tools.
- Confirm sensitive tool outputs now require appropriate authorization.
- Review saved GraphQL query access and execution permissions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-46515 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N——GitHub_MVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/mwtcmi/frogman/security/advisories/GHSA-q4c4-5cr4-8q47CVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/mwtcmi/frogman/issues/13CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/mwtcmi/frogman/issues/25CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/mwtcmi/frogman/commit/55ea257d5c24bc01c814a607faa7e76e86b111ecCVE reference, GitHub_M · x_refsource_MISC
- https://github.com/mwtcmi/frogman/commit/b8a8bfc12b564bcb77caef952873b9ffd4a98b00CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/mwtcmi/frogman/releases/tag/v1.6.3CVE reference, GitHub_M · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.