CVE-2026-72578 is a cross-site request forgery vulnerability in FreePBX Framework 17.0, the administrative layer commonly used with Asterisk-based telephony platforms.
Administrative AJAX handling does not enforce robust anti-CSRF controls. An unauthenticated attacker who can lure an authenticated administrator to a malicious page may trigger privileged administrative operations using the victim's existing session.
Because FreePBX often sits at the center of voice routing, trunk configuration, and operator access, CSRF against the admin plane can lead to high business and operational impact. Restrict admin interface exposure, enforce strong session cookie policies where possible, and follow official CVE and project updates for remediation.