https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 15:18:32 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-339423 EUVD-2026-339423 https://cve.radiocsirt.org/vuln/euvd-2026-339423 https://cve.radiocsirt.org/vuln/fkie_cve-2026-43946 <p>FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist. Version 1.3.1 patches the issue.</p> <p>FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist. Version 1.3.1 patches the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-43946 https://cve.radiocsirt.org/vuln/ghsa-fwcm-rqvw-j3p7 <p><strong>Affected:</strong> npm: fuxa-server</p> <p>### Summary An authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist.</p> <p>### Details The issue is caused by the combination of these code paths:</p> <p>- `server/api/apikeys/verify-api-or-token.js:45` sends requests without `x-api-key` to `authJwt.verifyToken(req, res, next)`. - `server/api/jwt-helper.js:46-64` creates a signed guest token when no `x-access-token` is provided: `if (!token) { token = getGuestToken(); }` and then populates `req.userId` / `req.userGroups` from that guest token. - `server/api/command/index.js:76-105` exposes `/api/getTagValue`. - `server/runtime/scripts/index.js:106-111` returns `true` when the referenced script does not exist: `if (!script) { return true; }`</p> <p>As a result, an unauthenticated request reaches `/api/getTagValue` as `guest`, and the authorization check is bypassed because `isAuthorisedByScriptName()` returns `true` when `sourceScriptName` is omitted or does not match a real script. The endpoint then returns arbitrary tag values by ID.</p> <p>### PoC</p> <p>Requests to /api/getTagValue without authentication could succeed when the authorization logic evaluated a non-existent sourceScriptName as authorized.</p> <p><strong>Affected:</strong> npm: fuxa-server</p> <p>### Summary An authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist.</p> <p>### Details The issue is caused by the combination of these code paths:</p> <p>- `server/api/apikeys/verify-api-or-token.js:45` sends requests without `x-api-key` to `authJwt.verifyToken(req, res, next)`. - `server/api/jwt-helper.js:46-64` creates a signed guest token when no `x-access-token` is provided: `if (!token) { token = getGuestToken(); }` and then populates `req.userId` / `req.userGroups` from that guest token. - `server/api/command/index.js:76-105` exposes `/api/getTagValue`. - `server/runtime/scripts/index.js:106-111` returns `true` when the referenced script does not exist: `if (!script) { return true; }`</p> <p>As a result, an unauthenticated request reaches `/api/getTagValue` as `guest`, and the authorization check is bypassed because `isAuthorisedByScriptName()` returns `true` when `sourceScriptName` is omitted or does not match a real script. The endpoint then returns arbitrary tag values by ID.</p> <p>### PoC</p> <p>Requests to /api/getTagValue without authentication could succeed when the authorization logic evaluated a non-existent sourceScriptName as authorized.</p> https://cve.radiocsirt.org/vuln/ghsa-fwcm-rqvw-j3p7