Vulnerability details

CVE-2026-43946

frangoteam FUXA

FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue

CVSS 4.0

7.7High

Official description

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist. Version 1.3.1 patches the issue.

CVSS scores

Score	Version	Source	Vector
7.7High	4.0	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P`

Affected products

Vendor	Product	Versions	Source
frangoteam	FUXA	= 1.3.0	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/frangoteam/FUXA/security/advisories/GHSA-fwcm-rqvw-j3p7 x_refsource_CONFIRM
https://github.com/frangoteam/FUXA/pull/2260 x_refsource_MISC
https://github.com/frangoteam/FUXA/commit/78534da61a91613712b44bb63c8d7da8c5df5ca4 x_refsource_MISC
https://github.com/frangoteam/FUXA/releases/tag/v1.3.1 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-07-22
Last updated: 2026-07-22
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.56%

Probability of exploitation in 30 days

47.1%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: Proof of concept
Technical impact: Partial

Weaknesses (CWE)

CWE-863
Incorrect Authorization