FUXA SCADA auth bypass exposes user data
An authentication bypass via dot-segment path normalization in Frangoteam FUXA SCADA/HMI ≤1.3.1 allows unauthenticated attackers to enumerate all user accounts and roles.
CISA has issued an advisory for CVE-2026-13207, an authentication bypass vulnerability in Frangoteam FUXA SCADA/HMI versions 1.3.1 and prior. The flaw stems from improper handling of dot-segment path normalization in the REST API router, which fails to normalize sequences before applying authentication middleware. Attackers can exploit this by prefixing API paths with dot-segments such as /api/./users, /api/./roles, or /api/project/../users to bypass authentication checks and access protected endpoints without credentials.
The vulnerability allows unauthenticated remote attackers to enumerate all user accounts and role assignments on affected FUXA instances, exposing sensitive user and role data. FUXA is deployed worldwide across critical manufacturing, energy, and water/wastewater sectors. Frangoteam has released version 1.3.2 to address the vulnerability, and users are urged to upgrade immediately.
CISA recommends minimizing network exposure for affected systems, ensuring they are not internet-accessible, and placing them behind firewalls isolated from business networks. No public exploitation has been reported to CISA at this time, though the vulnerability's technical details are now public.
Mentioned in this report
Detection guidance
FUXA REST API Auth Bypass via Dot-Segment Path Traversal
Detects HTTP requests to FUXA REST API endpoints containing dot-segment sequences (e.g. /api/./users, /api/project/../roles) used to bypass authentication middleware (CVE-2026-13207). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FUXA REST API Auth Bypass via Dot-Segment Path Traversal
id: 8c8de23f-6f2b-5854-a07f-5867bffc9214
status: experimental
description: 'Detects HTTP requests to FUXA SCADA/HMI REST API endpoints that include
dot-segment
sequences (./ or ../) within the path, which can bypass authentication middleware
due to improper path normalization (CVE-2026-13207). Attackers use paths such as
/api/./users, /api/./roles, or /api/project/../users to access protected endpoints
without credentials.
'
references:
- https://www.cisa.gov/
author: Vorant
tags:
- attack.t1190
logsource:
category: webserver
detection:
selection_api_path:
cs-uri-stem|contains: /api/
selection_dotseg:
cs-uri-stem|re: \/api\/(\.{1,2}\/)|\/api\/[^\/]+\/\.\.\/
filter_static:
cs-uri-stem|contains:
- /api/./static
- /api/./assets
condition: selection_api_path and selection_dotseg and not filter_static
falsepositives:
- Legitimate relative-path requests generated by misconfigured reverse proxies or
load balancers
- Automated vulnerability scanners testing path normalization (expected during authorized
pentests)
level: high
Unauthenticated Access to FUXA User/Role Enumeration Endpoints
Detects successful HTTP responses (200 OK) to FUXA /api/users or /api/roles endpoints without an accompanying authenticated session, indicating potential exploitation of the auth bypass to enumerate accounts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated Access to FUXA User or Role Enumeration Endpoints
id: a264d149-ff33-5337-8e0f-972a0fe74c45
status: experimental
description: 'Detects HTTP requests reaching FUXA''s /api/users or /api/roles endpoints
that
succeed (HTTP 200) without a valid session/authorization header being logged,
consistent with post-exploitation enumeration of accounts after bypassing
authentication via dot-segment path normalization (CVE-2026-13207).
'
references:
- https://www.cisa.gov/
author: Vorant
tags:
- attack.t1078
- attack.t1190
logsource:
category: webserver
detection:
selection_endpoint:
cs-uri-stem|contains:
- /api/users
- /api/roles
selection_success:
sc-status: 200
filter_authorized:
cs-cookie|contains: session=
condition: selection_endpoint and selection_success and not filter_authorized
falsepositives:
- Legitimate administrative access to user/role management pages with cookies stripped
from logs
- Internal monitoring or health-check scripts polling the API without session cookies
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-02
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free