{"id":"EUVD-2026-46442","enisaUuid":"632574b1-c1cf-390e-8bd2-1b98ac1298c2","description":"FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist. Version 1.3.1 patches the issue.","datePublished":"Jul 21, 2026, 9:27:29 PM","dateUpdated":"Jul 22, 2026, 3:02:58 PM","baseScore":7.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","references":"https://github.com/frangoteam/FUXA/security/advisories/GHSA-fwcm-rqvw-j3p7\nhttps://github.com/frangoteam/FUXA/pull/2260\nhttps://github.com/frangoteam/FUXA/commit/78534da61a91613712b44bb63c8d7da8c5df5ca4\nhttps://github.com/frangoteam/FUXA/releases/tag/v1.3.1\n","aliases":"CVE-2026-43946\nGHSA-fwcm-rqvw-j3p7\n","assigner":"GitHub_M","epss":0.57,"enisaIdProduct":[{"id":"5322f430-04bd-3a38-ad96-9a6979993ce0","product":{"name":"FUXA","vendor":{"name":"frangoteam"}},"product_version":"\u003d 1.3.0"}],"enisaIdVendor":[{"id":"85c63b38-b956-36b8-8d48-e3cc7764ee13","vendor":{"name":"frangoteam"}}],"enisaIdVulnerability":[{"id":"62795063-fd2d-3d87-a2a0-2313a1d10ad7","vulnerability":{"id":"GHSA-fwcm-rqvw-j3p7","description":"FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue","datePublished":"May 26, 2026, 11:41:45 PM","dateUpdated":"May 26, 2026, 11:41:45 PM","baseScore":0.0,"references":"https://github.com/frangoteam/FUXA/security/advisories/GHSA-fwcm-rqvw-j3p7\nhttps://github.com/frangoteam/FUXA/pull/2260\nhttps://github.com/frangoteam/FUXA/commit/78534da61a91613712b44bb63c8d7da8c5df5ca4\nhttps://github.com/frangoteam/FUXA\nhttps://github.com/frangoteam/FUXA/releases/tag/v1.3.1\n","enisa_id":"EUVD-2026-46442\n","aliases":"CVE-2026-43946\nGHSA-fwcm-rqvw-j3p7\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:03 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"e9594aa2-7fd7-3c6e-a974-a6943e96b96d","vulnerability":{"id":"CVE-2026-43946","description":"FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist. Version 1.3.1 patches the issue.","datePublished":"Jul 21, 2026, 9:27:29 PM","dateUpdated":"Jul 22, 2026, 3:02:58 PM","status":"PUBLISHED","baseScore":7.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","references":"https://github.com/frangoteam/FUXA/security/advisories/GHSA-fwcm-rqvw-j3p7\nhttps://github.com/frangoteam/FUXA/pull/2260\nhttps://github.com/frangoteam/FUXA/commit/78534da61a91613712b44bb63c8d7da8c5df5ca4\nhttps://github.com/frangoteam/FUXA/releases/tag/v1.3.1\n","enisa_id":"EUVD-2026-46442\n","assigner":"GitHub_M","epss":0.57,"dataProcessed":"Nov 7, 2026, 7:21:53 AM","vulnerabilityProduct":[{"id":"2dc255b9-b4ae-3b0d-87a6-51111ac785b1","product":{"name":"FUXA","vendor":{"name":"frangoteam"}},"product_version":"\u003d 1.3.0"}],"vulnerabilityVendor":[{"id":"b07fa53f-6b4f-3135-9a25-e3898411850a","vendor":{"name":"frangoteam"}}]}}],"enisaIdAdvisory":[]}