CVE-2026-94148 ScadaBR Export Project Endpoint export_project.htm EmportDwr.createExportJSON information disclosure
Remote attackers can access the export project endpoint to disclose sensitive information due to missing authorization checks in ScadaBR.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-94148?
CVE-2026-94148 is a medium-severity missing authorization vulnerability in ScadaBR, published on 21 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was determined in ScadaBR up to 1.1. Impacted is the function EmportDwr.createExportJSON of the file /ScadaBR/export_project.htm of the component Export Project Endpoint. This manipulation causes information disclosure. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.2.0 is recommended to address this issue. Patch name: c852b4988a15bce6011ef169299ad604538f70a9. The affected component should be upgraded. Import path was already gated with Permissions.ensureAdmin(); only export was left unprotected.
Which versions are affected by CVE-2026-94148?
How do I fix CVE-2026-94148?
No fix has been published for CVE-2026-94148 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-94148 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-94148 exists.
Sources
Also known as GHSA-w3gv-q645-g39f.