CVE-2019-19006

Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.

• CWE-287
• CWE-287

• https://community.freepbx.org/t/freepbx-security-vulnerability-sec-2019-001/62772Vendor Advisory
• https://pastebin.com/2CdsQMKWBroken Link
• https://wiki.freepbx.org/display/FOP/2019-11-20+Remote+Admin+Authentication+BypassVendor Advisory
• https://www.freepbx.org/category/blog/Product
• https://community.freepbx.org/t/freepbx-security-vulnerability-sec-2019-001/62772Vendor Advisory
• https://pastebin.com/2CdsQMKWBroken Link
• https://wiki.freepbx.org/display/FOP/2019-11-20+Remote+Admin+Authentication+BypassVendor Advisory
• https://www.freepbx.org/category/blog/Product
• https://research.checkpoint.com/2020/inj3ctor3-operation-leveraging-asterisk-servers-for-monetization/Exploit, Third Party Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-19006US Government Resource

Published

Nov 21, 2019

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-19000For ABB eSOMS 4.0 to 6.0.3, the Cache-Control and Pragma HTT…6.5
• CVE-2019-19001For ABB eSOMS versions 4.0 to 6.0.2, the X-Frame-Options hea…6.5
• CVE-2019-19002For ABB eSOMS versions 4.0 to 6.0.2, the X-XSS-Protection HT…5.4
• CVE-2019-19003For ABB eSOMS versions 4.0 to 6.0.2, the HTTPOnly flag is no…6.1
• CVE-2019-19004A biWidth*biBitCnt integer overflow in input-bmp.c in autotr…3.3
• CVE-2019-19005A bitmap double free in main.c in autotrace 0.31.1 allows at…7.8
• CVE-2019-19007Intelbras IWR 3000N 1.8.7 devices allow disclosure of the ad…7.2
• CVE-2019-19008Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-1901A vulnerability in the Link Layer Discovery Protocol (LLDP) …8.8
• CVE-2019-19010Eval injection in the Math plugin of Limnoria (before 2019.1…9.8
• CVE-2019-19011MiniUPnP ngiflib 0.4 has a NULL pointer dereference in GifIn…7.5
• CVE-2019-19012An integer overflow in the search_in_range function in regex…9.8