{"id":"CVE-2026-47718","aliases":["EUVD-2026-57691","GHSA-r9g5-7q8j-958c"],"status":"published","title":"FUXA provides guest and invalid-token access to protected read APIs in secure mode","description":"FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue.","severity":{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00458,"percentile":0.40003,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287","CWE-862"],"published":"2026-05-28T20:33:11Z","modified":"2026-10-28T02:30:54Z","fixes":[{"ecosystem":"npm","package":"fuxa-server","fixed_in":["1.3.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"fuxa-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.0-2773"},{"last_affected":"1.3.0-2773"},{"fixed":"1.3.1"}]}],"versions":["1.3.0-2773"]},{"source":"osv","ecosystem":"npm","package":"fuxa-server","ranges":[{"type":"SEMVER","events":[{"introduced":"1.3.0-2773"},{"fixed":"1.3.1"}]}],"versions":["1.3.0-2773"]}],"products":[{"vendor":"frangoteam","product":"fuxa"}],"references":[{"url":"https://github.com/frangoteam/FUXA/security/advisories/GHSA-r9g5-7q8j-958c","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/frangoteam/FUXA/releases/tag/v1.3.1","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-r9g5-7q8j-958c"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47718.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47718","tags":["advisory"]},{"url":"https://github.com/frangoteam/FUXA","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-47718","title":"FUXA provides guest and invalid-token access to protected read APIs in secure mode","description":"FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue.","status":"published","published":"2026-08-12T22:21:26.952Z","modified":"2026-08-14T22:23:07.95Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna"}],"cwes":["CWE-287","CWE-862"],"updated_at":"2026-11-02T13:36:40.478484Z"}],"euvd":[{"id":"EUVD-2026-57691","description":"FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue.","status":"published","published":"2026-08-12T22:21:26Z","modified":"2026-08-14T22:23:07Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T18:01:53.008072Z"}],"ghsa":[{"id":"GHSA-r9g5-7q8j-958c","title":"FUXA provides guest and invalid-token access to protected read APIs in secure mode","description":"### Summary\n\n  When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs.\n\n  ### Details\n\n  In secure mode, requests with no token or an explicitly invalid token were still able to access protected read endpoints.\n\n  Confirmed behavior:\n\n  - guest `GET /api/project` returned `200 OK`\n  - invalid-token requests to `/api/project` also returned successful responses containing project data\n  - guest and invalid-token requests also returned `200 OK` on:\n    - `/api/alarms`\n    - `/api/scheduler`\n\n  Relevant code paths identified during analysis:\n\n  - `server/api/jwt-helper.js`\n    - `verifyToken()` converts missing-token or invalid-token states into guest context instead of rejecting the request\n  - `server/api/projects/index.js`\n  - `server/api/alarms/index.js`\n  - `server/api/scheduler/index.js`\n\n  These handlers accepted the guest context and returned sensitive data in secure mode.\n\n  ### PoC\n\n  Tested only against isolated local lab instances under the original tester's control. No production, customer, shared, or third-party systems were involved.\n\n  Reproduction:\n\n  1. Start FUXA `1.3.0-2773`.\n  2. Set `secureEnabled=true`.\n  3. Send unauthenticated requests to:\n     - `GET /api/project`\n     - `GET /api/alarms`\n     - `GET /api/scheduler?id=test`\n  4. Observe `200 OK` responses.\n  5. Send the same requests with an explicitly invalid `x-access-token` value.\n  6. Observe the same successful responses.\n\n The exact HTTP requests and local PoC script used for confirmation can be provided upon request.\n\n  ### Impact\n\n  This is an authentication/authorization weakness in secure mode.\n\n  Impact includes:\n\n - project metadata disclosure\n - alarms disclosure\n - scheduler information disclosure\n - assistance in reconnaissance/follow-on attacks\n\n  Operators who believe secure mode protects these APIs are impacted.","status":"published","published":"2026-05-28T20:33:11Z","modified":"2026-05-28T20:33:11Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium"}],"cwes":["CWE-287","CWE-862"],"updated_at":"2026-11-02T14:40:14.666177Z"}],"nvd":[{"id":"CVE-2026-47718","description":"FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue.","status":"published","published":"2026-08-12T23:17:20.783Z","modified":"2026-10-23T19:10:00.167Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-287","CWE-862"],"updated_at":"2026-11-02T14:12:37.217486Z"}],"osv":[{"id":"CVE-2026-47718","title":"FUXA provides guest and invalid-token access to protected read APIs in secure mode","description":"FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue.","status":"published","published":"2026-08-12T22:21:26.952Z","modified":"2026-10-28T02:30:54.3107724Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium"}],"cwes":["CWE-287","CWE-862"],"updated_at":"2026-11-02T15:45:06.231145Z"},{"id":"GHSA-r9g5-7q8j-958c","title":"FUXA provides guest and invalid-token access to protected read APIs in secure mode","description":"### Summary\n\n  When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs.\n\n  ### Details\n\n  In secure mode, requests with no token or an explicitly invalid token were still able to access protected read endpoints.\n\n  Confirmed behavior:\n\n  - guest `GET /api/project` returned `200 OK`\n  - invalid-token requests to `/api/project` also returned successful responses containing project data\n  - guest and invalid-token requests also returned `200 OK` on:\n    - `/api/alarms`\n    - `/api/scheduler`\n\n  Relevant code paths identified during analysis:\n\n  - `server/api/jwt-helper.js`\n    - `verifyToken()` converts missing-token or invalid-token states into guest context instead of rejecting the request\n  - `server/api/projects/index.js`\n  - `server/api/alarms/index.js`\n  - `server/api/scheduler/index.js`\n\n  These handlers accepted the guest context and returned sensitive data in secure mode.\n\n  ### PoC\n\n  Tested only against isolated local lab instances under the original tester's control. No production, customer, shared, or third-party systems were involved.\n\n  Reproduction:\n\n  1. Start FUXA `1.3.0-2773`.\n  2. Set `secureEnabled=true`.\n  3. Send unauthenticated requests to:\n     - `GET /api/project`\n     - `GET /api/alarms`\n     - `GET /api/scheduler?id=test`\n  4. Observe `200 OK` responses.\n  5. Send the same requests with an explicitly invalid `x-access-token` value.\n  6. Observe the same successful responses.\n\n The exact HTTP requests and local PoC script used for confirmation can be provided upon request.\n\n  ### Impact\n\n  This is an authentication/authorization weakness in secure mode.\n\n  Impact includes:\n\n - project metadata disclosure\n - alarms disclosure\n - scheduler information disclosure\n - assistance in reconnaissance/follow-on attacks\n\n  Operators who believe secure mode protects these APIs are impacted.","status":"published","published":"2026-05-28T20:33:11Z","modified":"2026-05-28T20:56:25.62031Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P","level":"medium"}],"cwes":["CWE-287","CWE-862"],"updated_at":"2026-11-02T15:46:55.480549Z"}]}}