How to fix or mitigate CVE-2026-43946?

Within 24 hours, inventory all FUXA 1.3.0 deployments and assess which instances handle sensitive process tags; prioritize isolation of any systems connected to operational infrastructure. Within 7 days, apply the available vendor patch to all affected instances. Within 30 days, review access logs for signs of exploitation during the exposure window and confirm patch deployment across the full estate.

CVE-2026-43946

Q: What is the CVSS score of CVE-2026-43946?

CVE-2026-43946 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

HIGH

Incorrect Authorization (CWE-863)

2026-05-26 https://github.com/frangoteam/FUXA

GHSA-fwcm-rqvw-j3p7

Authentication Bypass

7.7

CVSS 4.0 · Vendor: https://github.com/frangoteam/FUXA

Severity by source

Vendor (https://github.com/frangoteam/FUXA) PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (https://github.com/frangoteam/FUXA) · only source for this CVE.

CVSS VectorVendor: https://github.com/frangoteam/FUXA

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 21, 2026 - 22:32 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 21, 2026 - 22:26 vuln.today

cvss_changed

CVSS changed

Jul 21, 2026 - 22:26 NVD

7.7 (HIGH)

Source Code Evidence Fetched

May 27, 2026 - 00:02 vuln.today

Analysis Generated

May 27, 2026 - 00:02 vuln.today

DescriptionCVE.org

Summary

An authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist.

Details

The issue is caused by the combination of these code paths:

server/api/apikeys/verify-api-or-token.js:45 sends requests without x-api-key to authJwt.verifyToken(req, res, next).
server/api/jwt-helper.js:46-64 creates a signed guest token when no x-access-token is provided:

if (!token) { token = getGuestToken(); } and then populates req.userId / req.userGroups from that guest token.

server/api/command/index.js:76-105 exposes /api/getTagValue.
server/runtime/scripts/index.js:106-111 returns true when the referenced script does not exist:

if (!script) { return true; }

As a result, an unauthenticated request reaches /api/getTagValue as guest, and the authorization check is bypassed because isAuthorisedByScriptName() returns true when sourceScriptName is omitted or does not match a real script. The endpoint then returns arbitrary tag values by ID.

PoC

Requests to /api/getTagValue without authentication could succeed when the authorization logic evaluated a non-existent sourceScriptName as authorized.

AnalysisAI

Unauthenticated tag value disclosure in FUXA 1.3.0 lets remote attackers read arbitrary process tag values via the /api/getTagValue endpoint by exploiting a guest-token authorization bypass. Because the authorization helper treats a non-existent sourceScriptName as authorized, any request without an x-api-key or x-access-token is silently promoted to a signed guest identity and passes the check. Publicly available exploit code exists (CVSS 4.0 base 7.7, confidentiality-only impact); EPSS is low at 0.11% and it is not on CISA KEV.