CVE-2026-72586CWE-306

CVE-2026-72586

High · published August 10, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
49.7
In the wild
Unconfirmed
What it is

A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQ_QUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events (DEVICE_BROWSE, HOST_INTERFACES, DEVICE_TAGS_REQUEST, etc.) call isSocketAdminAuthorized to verify the connection token, but the DAQ_QUERY handler in server/runtime/index.js lacks this check entirely.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00633 · 49.7th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-08-10T15:17Z
References (2)
https://github.com/frangoteam/FUXA · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2chttps://github.com/frangoteam/FUXA/blob/master/server/runtime/index.js · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
EPSS history
Timeline
  • 10 AUG 10:41Z
    frangoteam FUXA - Missing Authentication on DAQ_QUERY Socket.IO Event Handler
    cvelistv5