CVE-2026-94148: ScadaBR Export Project Endpoint export_project.htm EmportDwr.createExportJSON information disclosure
A vulnerability was determined in ScadaBR up to 1.1. Impacted is the function EmportDwr.createExportJSON of the file /ScadaBR/exportproject.htm of the component Export Project Endpoint. This manipulation causes information disclosure. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.2.0 is recommended to address this issue. Patch name: c852b4988a15bce6011ef169299ad604538f70a9. The affected component should be upgraded. Import path was already gated with Permissions.ensureAdmin(); only export was left unprotected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ScadaBR Export Project Endpoint (export_project.htm) - EmportDwr.createExportJSONto a version that resolves this vulnerability.Fixed in 1.2.0Patch c852b4988a15bce6011ef169299ad604538f70a9
Event History
Frequently Asked Questions
Who can exploit the issue?
A remote attacker does not need authentication or user interaction. The export functionality was left unprotected, unlike the import path, which is gated by Permissions.ensureAdmin().
Which deployments are affected?
ScadaBR versions up to 1.1 are affected. Version 1.2.0 is recommended to address the issue.
Is there public exploit availability?
Yes. The exploit has been publicly disclosed and may be used by attackers.
What should teams do if they cannot upgrade immediately?
The provided data identifies upgrading the affected component to ScadaBR 1.2.0 as the remediation. It does not specify a temporary workaround; restrict remote access to the export endpoint where possible until the upgrade can be completed.