Is CVE-2026-43946 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-43946 being exploited in the wild.

How severe is CVE-2026-43946?

High severity, with a CVSS score of 4, published 21 July 2026.

Which products and versions are affected?

Frangoteam FUXA 1.3.0; fuxa-server (npm) = 1.3.0, SEMVER:introduced=1.3.0,fixed=1.3.1.

Is there a fix for CVE-2026-43946?

Yes. fuxa-server (npm): upgrade to 1.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-43946 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-43946?

Check whether you run Frangoteam FUXA or fuxa-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-43946: frangoteam FUXA authorization bypass in /api/getTagValue

CVE-2026-43946 · Severity: high · CVSS 4 · Published 2026-07-21

FUXA is a web-based industrial automation platform used for monitoring and controlling industrial processes (SCADA/HMI). A security flaw in version 1.3.0 allows unauthorized individuals to view sensitive operational data, known as 'tag values,' without logging in. This could allow an attacker to monitor real-time industrial processes or harvest proprietary operational data, potentially compromising the confidentiality of the facility's operations.

Technologies: Frangoteam FUXA, fuxa-server (npm). Vendors: Frangoteam, npm.

Quick answers

Is CVE-2026-43946 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-43946 being exploited in the wild.
How severe is CVE-2026-43946?: High severity, with a CVSS score of 4, published 21 July 2026.
Which products and versions are affected?: Frangoteam FUXA 1.3.0; fuxa-server (npm) = 1.3.0, SEMVER:introduced=1.3.0,fixed=1.3.1.
Is there a fix for CVE-2026-43946?: Yes. fuxa-server (npm): upgrade to 1.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-43946 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-43946?: Check whether you run Frangoteam FUXA or fuxa-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

fuxa-server (npm): upgrade to 1.3.1 or later
```
npm install fuxa-server@1.3.1
```

Technical details

An authorization bypass exists in FUXA version 1.3.0 within the /api/getTagValue endpoint. The vulnerability stems from a logic error where the system automatically assigns a 'guest' token to unauthenticated requests and the authorization check function, isAuthorisedByScriptName(), incorrectly returns 'true' if a referenced script name is missing or non-existent. An attacker can exploit this by sending specially crafted network requests to the API without any credentials to retrieve arbitrary tag values by ID. This issue is resolved in version 1.3.1 by hardening the request routing logic and authorization validation.

Affected products

frangoteam FUXA 1.3.0

Identifiers

CVE-2026-43946
GHSA-fwcm-rqvw-j3p7

Timeline

2026-03-19: patched: Fix merged into master branch
2026-04-09: patched: Official release of version 1.3.1
2026-05-19: advisory: GitHub Security Advisory published
2026-07-21: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.