What’s Vulnerable › Vulnerabilities

CVE-2026-43946: FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue

• Severity: high (CVSS 7.7 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-21 · updated 2026-10-24
• Weakness: CWE-863

Description

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist. Version 1.3.1 patches the issue.

Affected products

• frangoteam FUXA: = 1.3.0

References

• https://github.com/frangoteam/FUXA/commit/78534da61a91613712b44bb63c8d7da8c5df5ca4
• https://github.com/frangoteam/FUXA/pull/2260
• https://github.com/frangoteam/FUXA/releases/tag/v1.3.1
• https://github.com/frangoteam/FUXA/security/advisories/GHSA-fwcm-rqvw-j3p7

Get alerted when CVE-2026-43946 or the next vulnerability affects your stack