A vulnerability in the /api/getTagValue endpoint allows an attacker who does not provide credentials to retrieve arbitrary tag values when the referenced script is missing. The exposed data can contain sensitive operational parameters, potentially revealing critical process conditions. The lack of authentication grants attackers access to this privileged information, constituting a confidentiality breach rather than an integrity compromise.

The issue is present in FUXA web‑based process visualization software version 1.3.0, released by frangoteam. The mitigation was published in release 1.3.1, which removes the unauthorized access path.

The CVSS score of 7.7 indicates a moderate‑to‑high severity, while the EPSS score of less than 1% shows a low likelihood of exploitation in the wild. CISA KEV, suggesting no known public exploitation. The likely attack vector is a simple HTTP request to /api/getTagValue without authentication, inferred from the description of the authorization bypass.