ProductThird-party advisory
https://github.com/frangoteam/FUXA CVE-2026-72586
HIGH
frangoteam FUXA - Missing Authentication on DAQ_QUERY Socket.IO Event Handler
Record summary
CVE-2026-72586 has a selected CVSS score of 7.5 (high).
Description
A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQ_QUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events (DEVICE_BROWSE, HOST_INTERFACES, DEVICE_TAGS_REQUEST, etc.) call isSocketAdminAuthorized to verify the connection token, but the DAQ_QUERY handler in server/runtime/index.js lacks this check entirely.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 10, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Default status: unknown | CVE List | Through 1.3.3 | affected |
References
3Vulnerable FileTechnical description
https://github.com/frangoteam/FUXA/blob/master/server/runtime/index.js nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-72586