p PatchFirst

CVE-2026-43946

CVE-2026-43946 · FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue

This page contains facts from public vulnerability sources. Check the original advisory before updating.

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist. Version 1.3.1 patches the issue.

CVSS 7.7 · High · EPSS 0.6% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • fuxa

    Versions
    • = 1.3.0: Affected

    No fix published

  • fuxa-server npm

    Versions
    • 1.3.0
    Affected ranges
    • SEMVER: ≥ 1.3.0, < 1.3.1

    Update to 1.3.1

Original sources

Check your server →