CVE-2026-72586

The CVSS 7.5 score for CVE-2026-72586 is a distraction. The real issue isn't that one event handler lacks an authorization check — it's that every other handler in the FUXA system has it. The presence of `isSocketAdminAuthorized` in DEVICE_BROWSE, HOST_INTERFACES, DEVICE_TAGS_REQUEST, and elsewhere demonstrates the development team understood the threat model and implemented authentication guards as a standard practice. DAQ_QUERY is the exception that proves the rule, and understanding why it exists is more important than the missing check itself. The likely explanation is temporal: DAQ_QUERY was either written before the auth layer was established and never updated, or it was refactored at a point when the developer didn't consciously apply the now-standard pattern. This is "exceptional handler syndrome" — it never appears randomly. Early data access primitives get built for convenience, not access control, and accumulate data because that's their job. Handlers written later by developers who've internalized security requirements accumulate controls because that's the normative context. The fossil handler ends up with the most exposure because it was the original data access primitive. For defenders, the priority question isn't just whether to add the missing check — it's whether DAQ_QUERY's exception status has cousins. Audit other event handlers for the same pattern: where `secureEnabled` is checked at a coarse level but individual operations skip granular authorization. The deeper question is whether your threat model accounted for what aggregated sensor data becomes over time. If the answer is no, even a thorough code review during auth implementation wouldn't have flagged this as high-risk. Operationally, treat historical sensor data accessed through unauthenticated DAQ_QUERY as having potential intelligence value to an attacker. Months of operational patterns — shift schedules, facility utilization, physical security rhythms — may already be compromised. This changes incident response scope beyond patching the code. Architecturally, the manual auth-call pattern is thermodynamically doomed. The fix isn't better reviews — it's refactoring to make auth checks the default: a middleware layer, decorator, or base class where authorization fires before business logic executes, not after a developer remembers to write it.

Reviewed through automated stages and approved by a human before publication.