CVE-2026-13207 describes an authentication bypass vulnerability in Frangoteam's FUXA SCADA/HMI product versions 1.3.1 and prior. The REST API router fails to normalize dot-segment path sequences (e.g., /api/./users or /api/project/../users) before applying authentication middleware. This improper path normalization allows attackers to bypass authentication and access protected endpoints, resulting in unauthorized disclosure of sensitive user and role data. The vulnerability is classified under CWE-290 (Authentication Bypass).

Unauthenticated attackers can bypass authentication controls on the REST API and retrieve sensitive user and role information. This exposure can lead to further attacks or unauthorized access within the affected system. The CVSS v4.0 score is 8.7 (high severity), reflecting the network attack vector, no required privileges or user interaction, and high impact on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the REST API to trusted networks and monitor for suspicious requests that use dot-segment path prefixes to bypass authentication.