FreePBX Flaw Exposes User Portals to Unauthorized Access

**FreePBX userman (CVE-2026-46376)** — A critical (CVSS v4.0 9.1) hard-coded credential vulnerability in the FreePBX userman module's UCP generic template can permit unauthenticated access to the User Control Panel if embedded sample passwords were not rotated. Affected FreePBX 16 (<16.0.45) and 17 (<17.0.7) have been patched (16.0.45, 17.0.7); administrators are advised to update immediately, restrict administrative access, deploy firewall controls, audit UCP sessions, and rotate credentials.