Unauthorized Object Access in TREX-MES Applications (CVE-2026-18783)

Overview

TREX MES is a commercial Manufacturing Execution System (MES) / Industry 4.0 platform used to collect and manage data from the production floor. In the conducted studies, it was determined that requests sent to the /api/GetDataJSON3 API endpoint could be successfully processed even without a valid Authorization: Bearer token. Instead of rejecting requests without a token with 401 Unauthorized or 403 Forbidden, the endpoint processes them and produces a response. This situation indicates that server-side authentication control in the relevant API service is missing or misconfigured.

Impact

Any unauthenticated attacker who can reach the service over the network can:

• Query data through the API and receive responses; access application data without possessing any credentials.
• Analyze the application's business logic, data model, and internal structure; gather intelligence for subsequent attack steps.
• Use the service outside the normal user flow; bypass the restrictions enforced by the interface (menu permissions, facility/period selection, field validations).
• Operate outside authentication-dependent rate limiting, session tracking, and audit logging mechanisms, performing actions without being associated with a user account.

The same endpoint directly executes content sent via the sql parameter in the database. The lack of authentication removes the "valid session" prerequisite of the arbitrary SQL execution vulnerability in question; the PR:L component in the CVSS vector is updated to PR:N, and the base score rises from 9.9 to 10.0.

Since the affected system is a manufacturing execution platform, the ability to query production and quality data without authentication carries commercial confidentiality breaches and operational risk beyond the usual IT impact.

Related Weaknesses

Authentication control is enforced only by the application's front end; the token is added to requests on the client side, while its presence and validity are not enforced on the server side. When the endpoint is called directly, this control is completely disabled and the request is processed. This behavior was verified in the tested installation.

CWE-306 — Missing Authentication for Critical Function CWE-862 — Missing Authorization CWE-425 — Direct Request (Forced Browsing) CWE-602 — Client-Side Enforcement of Server-Side Security

Severity

High — CVSS 3.1 Base Score 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

The score pertains to the evaluation of the finding on its own (unauthorized data querying). When considered together with the arbitrary SQL execution vulnerability at the same endpoint, the impact is critical.

Affected Versions

trex MES v.6.07.17.00090 and earlier

TrexDCAS MES v.6.05.14.00074 and earlier

Affected Component

/api/GetDataJSON3 — request authentication control in the web service layer

Mitigating Measures

Until the vendor fix is released, operators are advised to implement the following:

At the reverse proxy, WAF, or IIS URL Authorization layer, reject requests to the /api/GetDataJSON3 endpoint that do not carry a valid Authorization header. Not only the presence of the header but also its signature and validity period must be verified; otherwise, the control can be bypassed by sending a random value.

Restrict access to the endpoint to the IP addresses of production clients that require it only; disable access from the corporate user network and the internet.

Assuming the vulnerability is not limited to a single endpoint, test all endpoints under /api/ (including GetDataJSONCrypto3) without sending a token; include other endpoints that respond without authentication in the same rule set.

Define a SIEM alarm for requests reaching the endpoint without an Authorization header, and retrospectively review the web server logs for any past access matching this pattern.

For a permanent fix, the vendor must enforce authentication on the server side, implement this control through a centralized layer (global filter / middleware) that covers all endpoints and denies by default rather than through checks added to individual endpoints, verify after authentication that the session owner has the right to access the requested data, and reject unauthorized requests with 401/403 without leaking internal structure information in the response body.

CVE ID

CVE-2026-18783

Discoverer

Hasan Hüseyin UYAR – Netlore Security

Disclosure Timeline

Date	Event
2026-07-30	The vulnerability was detected and confirmed during an authorized penetration test
2026-08-04	CVE-2026-18783 ID was assigned.
2026-09-30	Published at https://www.cve.org/CVERecord?id=CVE-2026-18783.