CVE-2026-72586

Name of the Vulnerable Software and Affected Versions frangoteam/FUXA versions prior to 1.3.4

Description A missing authentication flaw allows an unauthenticated remote attacker to query all historical sensor data. This occurs because the DAQ QUERY Socket.IO event handler in server/runtime/index.js does not call the isSocketAdminAuthorized() function to verify the connection token, even when secureEnabled is set to true. Other sensitive Socket.IO events, such as DEVICE BROWSE, HOST INTERFACES, and DEVICE TAGS REQUEST, correctly implement this authorization check.

Recommendations Update frangoteam/FUXA to version 1.3.4 or later. As a temporary mitigation, restrict access to the DAQ QUERY Socket.IO event.