Cross-extension call-data disclosure via trusted extension parameter

Improper access control in Sangoma FreePBX CDR and CEL modules allows remote authenticated users to read other extensions' call data. The UCP ajax.php grid handlers accept a caller-controlled extension value instead of restricting queries to the session's own extension, so replacing self with another extension returns that extension's records. A valid non-administrator UCP session is required; the disclosed records include call history, and returned details can include recordings.