CVE-2026-94148
Deferred Deferred - Pending Action

Information Disclosure in ScadaBR Export Project Endpoint

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: VulDB

Description
A vulnerability was determined in ScadaBR up to 1.1. Impacted is the function EmportDwr.createExportJSON of the file /ScadaBR/export_project.htm of the component Export Project Endpoint. This manipulation causes information disclosure. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.2.0 is recommended to address this issue. Patch name: c852b4988a15bce6011ef169299ad604538f70a9. The affected component should be upgraded. Import path was already gated with Permissions.ensureAdmin(); only export was left unprotected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-94148
EUVD
EUVD-2026-83857

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
scadabr scadabr to 1.1 (inc)
scadabr scadabr 1.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in ScadaBR up to version 1.1 allows remote attackers to disclose sensitive information through the Export Project Endpoint. The flaw exists in the EmportDwr.createExportJSON function of the /ScadaBR/export_project.htm file. The issue arises because the export functionality lacked proper authorization checks, unlike the import path which was already protected by Permissions.ensureAdmin().

Detection Guidance

Check for unauthorized access attempts to the /ScadaBR/export_project.htm endpoint. Monitor logs for unusual export requests or data exfiltration attempts. Verify if the EmportDwr.createExportJSON function is being called without proper admin permissions.

Impact Analysis

An attacker could exploit this to access confidential project data, including system configurations and settings. Since ScadaBR is used for industrial process monitoring, leaked data might reveal operational details or vulnerabilities in critical infrastructure. The attack is remote and does not require authentication.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's safeguards for sensitive health information. Organizations using affected ScadaBR versions may face compliance violations, legal penalties, or reputational damage due to potential data breaches.

Mitigation Strategies

Upgrade ScadaBR to version 1.2.0 or later immediately. Ensure the Export Project Endpoint is protected by admin permissions. Disable debug mode in the DWR servlet by setting param-value to false in web.xml.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94148. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart