CVE-2026-13207 is an authentication bypass vulnerability in Frangoteam's FUXA SCADA/HMI product affecting versions up to and including 1.3.1. The vulnerability arises because the API router does not normalize dot-segment sequences (e.g., "." and "..") in request paths before applying authentication middleware. Attackers can exploit this by crafting requests with dot-segment prefixes that circumvent authentication, gaining unauthorized access to sensitive endpoints such as /api/users and /api/roles. This results in exposure of sensitive user and role information without requiring credentials. The CVSS v4.0 base score is 8.7 (high severity), reflecting network attack vector, no privileges or user interaction needed, and high impact on confidentiality.

Successful exploitation allows unauthenticated attackers to bypass authentication controls and retrieve sensitive user and role data from the FUXA SCADA/HMI REST API. This compromises confidentiality and potentially aids further attacks by revealing privileged information. There is no indication of integrity or availability impact. No known exploits in the wild have been reported at this time.

No official patch or remediation is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the REST API to trusted networks and consider implementing additional access controls or network-level protections to prevent unauthenticated access. Monitor vendor communications for updates on patches or official mitigations.