Vulnerability · Published Aug 18, 2026 · Assigned by GitHub_M

CVE-2026-67440FUXA: Unauthenticated Socket.IO read events

Medium 6.9

In plain English

A medium-severity missing authorization in FUXA from frangoteam. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.5%top 54.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, and DEVICE_TAGS_REQUEST handlers in server/runtime/index.js return device-discovery, node-attribute, host-network-interface, and device-tag metadata without isSocketAdminAuthorized when secureEnabled is true. A remote unauthenticated or guest user can invoke these metadata-oriented Socket.IO events and collect system-discovery information that is not required for normal public HMI viewing, while ordinary device status, value, alarm, and dashboard events remain intentionally public. This issue is fixed in version 1.3.3.

Affected products (as reported)

Vendor	Product	Versions
frangoteam	FUXA	< 1.3.3

Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/frangoteam/FUXA/security/advisories/GHSA-rh5p-m38p-2w75 x_refsource_CONFIRM
https://github.com/frangoteam/FUXA/pull/2379 x_refsource_MISC
https://github.com/frangoteam/FUXA/commit/4fa47d0a2a856ed34f427f472fb4450f86e7749b x_refsource_MISC
https://github.com/frangoteam/FUXA/releases/tag/v1.3.3 x_refsource_MISC