# FUXA SCADA auth bypass exposes user data

Published: 2026-06-30 · Severity: high · Sectors: manufacturing, energy, infrastructure
Canonical: https://vorant.io/reports/0e5a2d73-6150-5bed-8262-6c5e489332d1/fuxa-scada-auth-bypass-exposes-user-data

> An authentication bypass via dot-segment path normalization in Frangoteam FUXA SCADA/HMI ≤1.3.1 allows unauthenticated attackers to enumerate all user accounts and roles.

CISA has issued an advisory for CVE-2026-13207, an authentication bypass vulnerability in Frangoteam FUXA SCADA/HMI versions 1.3.1 and prior. The flaw stems from improper handling of dot-segment path normalization in the REST API router, which fails to normalize sequences before applying authentication middleware. Attackers can exploit this by prefixing API paths with dot-segments such as /api/./users, /api/./roles, or /api/project/../users to bypass authentication checks and access protected endpoints without credentials.

The vulnerability allows unauthenticated remote attackers to enumerate all user accounts and role assignments on affected FUXA instances, exposing sensitive user and role data. FUXA is deployed worldwide across critical manufacturing, energy, and water/wastewater sectors. Frangoteam has released version 1.3.2 to address the vulnerability, and users are urged to upgrade immediately.

CISA recommends minimizing network exposure for affected systems, ensuring they are not internet-accessible, and placing them behind firewalls isolated from business networks. No public exploitation has been reported to CISA at this time, though the vulnerability's technical details are now public.

## Mentioned in this report

- Vulnerabilities: CVE-2026-13207

## Detection guidance (public sample)

### FUXA REST API Auth Bypass via Dot-Segment Path Traversal

ATT&CK: T1190

Detects HTTP requests to FUXA REST API endpoints containing dot-segment sequences (e.g. /api/./users, /api/project/../roles) used to bypass authentication middleware (CVE-2026-13207). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: FUXA REST API Auth Bypass via Dot-Segment Path Traversal
id: 8c8de23f-6f2b-5854-a07f-5867bffc9214
status: experimental
description: 'Detects HTTP requests to FUXA SCADA/HMI REST API endpoints that include
  dot-segment

  sequences (./ or ../) within the path, which can bypass authentication middleware

  due to improper path normalization (CVE-2026-13207). Attackers use paths such as

  /api/./users, /api/./roles, or /api/project/../users to access protected endpoints

  without credentials.

  '
references:
- https://www.cisa.gov/
author: Vorant
tags:
- attack.t1190
logsource:
  category: webserver
detection:
  selection_api_path:
    cs-uri-stem|contains: /api/
  selection_dotseg:
    cs-uri-stem|re: \/api\/(\.{1,2}\/)|\/api\/[^\/]+\/\.\.\/
  filter_static:
    cs-uri-stem|contains:
    - /api/./static
    - /api/./assets
  condition: selection_api_path and selection_dotseg and not filter_static
falsepositives:
- Legitimate relative-path requests generated by misconfigured reverse proxies or
  load balancers
- Automated vulnerability scanners testing path normalization (expected during authorized
  pentests)
level: high
```

### Unauthenticated Access to FUXA User/Role Enumeration Endpoints

ATT&CK: T1078

Detects successful HTTP responses (200 OK) to FUXA /api/users or /api/roles endpoints without an accompanying authenticated session, indicating potential exploitation of the auth bypass to enumerate accounts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Unauthenticated Access to FUXA User or Role Enumeration Endpoints
id: a264d149-ff33-5337-8e0f-972a0fe74c45
status: experimental
description: 'Detects HTTP requests reaching FUXA''s /api/users or /api/roles endpoints
  that

  succeed (HTTP 200) without a valid session/authorization header being logged,

  consistent with post-exploitation enumeration of accounts after bypassing

  authentication via dot-segment path normalization (CVE-2026-13207).

  '
references:
- https://www.cisa.gov/
author: Vorant
tags:
- attack.t1078
- attack.t1190
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains:
    - /api/users
    - /api/roles
  selection_success:
    sc-status: 200
  filter_authorized:
    cs-cookie|contains: session=
  condition: selection_endpoint and selection_success and not filter_authorized
falsepositives:
- Legitimate administrative access to user/role management pages with cookies stripped
  from logs
- Internal monitoring or health-check scripts polling the API without session cookies
level: medium
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-02

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/0e5a2d73-6150-5bed-8262-6c5e489332d1/fuxa-scada-auth-bypass-exposes-user-data.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup