Authorization bypass in FUXA /api/getTagValue endpoint (CVE-2026-43946)

An authorization bypass vulnerability in the FUXA SCADA/HMI platform allows unauthenticated users to retrieve arbitrary tag values via the /api/getTagValue endpoint. The flaw arises because the authorization check isAuthorisedByScriptName() returns true when the referenced script does not exist, and the authentication middleware issues a signed guest token to requests lacking credentials, enabling unauthenticated access to sensitive tag data by ID. Affected versions: - 1.3.0 We recommend updating to: >= 1.3.1. CVSS 7.7 · our assessment: this_week Reference: https://github.com/frangoteam/FUXA/security/advisories/GHSA-fwcm-rqvw-j3p7 Details: https://vuln.today/cve/CVE-2026-43946