CVE-2026-43946: 
JavaScript vulnerability analysis and mitigation

CVE-2026-43946 is an authorization bypass vulnerability in FUXA, an open-source web-based SCADA/HMI platform, that allows unauthenticated attackers to read arbitrary tag values via the /api/getTagValue endpoint. It affects the npm package fuxa-server (and @frangoteam/fuxa) version 1.3.0 only; version 1.3.1 contains the fix. The vulnerability was reported by researcher anyzy2003, published as a GitHub Security Advisory on May 19, 2026, and added to the GitHub Advisory Database on May 26, 2026. It carries a CVSS v4.0 base score of 7.7 (High) (GitHub Advisory, FUXA Advisory).

The root cause is an Incorrect Authorization flaw (CWE-863) arising from the interaction of four code paths. First, server/api/apikeys/verify-api-or-token.js:45 forwards requests lacking an x-api-key header to authJwt.verifyToken(). Second, server/api/jwt-helper.js:46-64 silently mints a signed guest token when no x-access-token is present (if (!token) { token = getGuestToken(); }), populating req.userId and req.userGroups with guest-level context. Third, the /api/getTagValue endpoint exposed in server/api/command/index.js:76-105 then calls isAuthorisedByScriptName() to check permissions. Fourth, server/runtime/scripts/index.js:106-111 returns true when the referenced script does not exist (if (!script) { return true; }), meaning any request that omits or supplies a non-existent sourceScriptName parameter is treated as authorized. An unauthenticated attacker can therefore query tag values by ID with no credentials whatsoever (GitHub Advisory, Security Fix Commit).

Successful exploitation results in unauthenticated disclosure of arbitrary tag values stored in the FUXA instance, which in an industrial/OT context may include sensor readings, process variables, equipment states, or other operational data. Because FUXA is commonly deployed as a SCADA/HMI front-end, exposed tag values could reveal sensitive operational technology (OT) process information to adversaries, potentially enabling reconnaissance for further attacks against industrial control systems. There is no integrity or availability impact from this vulnerability itself, but the confidentiality breach could facilitate targeted physical-process attacks or competitive intelligence gathering (GitHub Advisory, FUXA Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible FUXA instances running fuxa-server version 1.3.0 using tools like Shodan (search for FUXA-specific HTTP banners or default ports) or by directly probing the /api/getTagValue endpoint.
2. Craft unauthenticated request: Send an HTTP GET request to /api/getTagValue without any x-api-key or x-access-token headers. The server will automatically assign a guest token internally.
3. Bypass authorization: Omit the sourceScriptName query parameter entirely, or supply a value that does not match any existing script name (e.g., sourceScriptName=nonexistent). The isAuthorisedByScriptName() function returns true for non-existent scripts, bypassing the authorization check.
4. Retrieve tag values: Include the target tag ID in the request (e.g., GET /api/getTagValue?tagId=<id>&sourceScriptName=nonexistent). The server responds with the tag value without requiring authentication.
5. Enumerate tags: Iterate over known or guessed tag IDs to enumerate all accessible tag values from the FUXA instance (GitHub Advisory, Security Fix Commit).

• Network: Repeated unauthenticated HTTP GET requests to /api/getTagValue from external or unexpected IP addresses, particularly with missing or unusual sourceScriptName query parameters; high-frequency enumeration of tag IDs from a single source IP.
• Logs: FUXA server access logs showing GET /api/getTagValue requests with no x-api-key or x-access-token headers returning HTTP 200 responses; absence of corresponding authenticated session activity from the same source.
• Logs: Server-side log entries showing api get getTagValue without preceding authentication events, or guest-token-based access to the endpoint outside of expected application flows.

The fix is available in fuxa-server (npm) version 1.3.1 and @frangoteam/fuxa >= 1.3.1. The patch corrects server/runtime/scripts/index.js to return false instead of true when a referenced script does not exist, and also hardens the Node-RED dashboard routing logic. Operators should upgrade to FUXA v1.3.1 immediately. As a temporary workaround prior to patching, restrict network access to the FUXA API port using firewall rules or place the instance behind a VPN or authenticated reverse proxy to prevent unauthenticated external access (FUXA v1.3.1 Release, Security Fix Commit, Security Fix PR).

The vulnerability was responsibly disclosed by researcher anyzy2003 and acknowledged by the FUXA maintainer (unocelli), who thanked security researchers in the PR description. The fix was merged on March 19, 2026, and the advisory was published on May 19, 2026. The issue was noted in npm/PyPI supply chain threat roundups and briefly discussed on Reddit's r/cybersecurity community (Security Fix PR, Reddit).