CVE-2026-13207: Frangoteam FUXA SCADA/HMI Authentication Bypass by Spoofing
FUXA versions 1.3.1 and prior contain an authentication bypass vulnerability via dot-segment path normalization in the REST API. The API router fails to normalize dot-segment sequences before applying authentication middleware, allowing unauthenticated requests to access protected endpoints by prefixing paths with dot-segments such as /api/./users, /api/./roles, and /api/project/../users. These requests bypass authentication checks and return sensitive user and role data without credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FUXAto a version that resolves this vulnerability.Fixed in 1.3.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13207?
The severity of CVE-2026-13207 is classified as high with a score of 7.5.
How does CVE-2026-13207 affect Frangoteam FUXA?
CVE-2026-13207 allows an authentication bypass through dot-segment path normalization in the REST API, enabling unauthorized access to protected endpoints.
Which versions of Frangoteam FUXA are vulnerable to CVE-2026-13207?
Frangoteam FUXA versions 1.3.1 and earlier are vulnerable to CVE-2026-13207.
How do I fix CVE-2026-13207?
To fix CVE-2026-13207, upgrade to a version of Frangoteam FUXA later than 1.3.1 that includes the necessary security updates.
What is the impact of exploiting CVE-2026-13207?
Exploiting CVE-2026-13207 can allow an attacker to access sensitive data and perform unauthorized actions within the SCADA/HMI system.