CVE-2026-67440

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, and DEVICE_TAGS_REQUEST handlers in server/runtime/index.js return device-discovery, node-attribute, host-network-interface, and device-tag metadata without isSocketAdminAuthorized when secureEnabled is true. A remote unauthenticated or guest user can invoke these metadata-oriented Socket.IO events and collect system-discovery information that is not required for normal public HMI viewing, while ordinary device status, value, alarm, and dashboard events remain intentionally public. This issue is fixed in version 1.3.3.

• CWE-862

• https://github.com/frangoteam/FUXA/commit/4fa47d0a2a856ed34f427f472fb4450f86e7749b
• https://github.com/frangoteam/FUXA/pull/2379
• https://github.com/frangoteam/FUXA/releases/tag/v1.3.3
• https://github.com/frangoteam/FUXA/security/advisories/GHSA-rh5p-m38p-2w75

Published

Aug 18, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-67435linuxfabrik-lib provides Python modules for database access,…6
• CVE-2026-67436Linuxfabrik monitoring-plugins provides Python monitoring pl…8.3
• CVE-2026-67437OliveTin gives access to predefined shell commands from a we…7.5
• CVE-2026-67438OliveTin gives access to predefined shell commands from a we…6.6
• CVE-2026-67439OliveTin gives safe and simple access to predefined shell co…4.3
• CVE-2026-6744A vulnerability was found in Bagisto up to 2.3.15. Affected …6.3
• CVE-2026-67442FUXA is a web-based Process Visualization (SCADA/HMI/Dashboa…2
• CVE-2026-67443FUXA is a web-based Process Visualization (SCADA/HMI/Dashboa…9.2
• CVE-2026-67445Mailpit is an email testing tool and API for developers. Pri…5.3
• CVE-2026-67446Mailpit is an email testing tool and API for developers. Pri…5.3
• CVE-2026-67447Mailpit is an email testing tool and API for developers. Fro…5.3
• CVE-2026-67448Mailpit is an email testing tool and API for developers. Fro…6.5