PT-2026-44733 · Fuxa · Fuxa

Published

2026-05-28

·

Updated

2026-05-29

·

CVE-2026-47718

CVSS v4.0

5.5

Medium

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Name of the Vulnerable Software and Affected Versions FUXA version 1.3.0-2773
Description When secureEnabled is set to true, the software fails to properly restrict access to protected read endpoints. Requests made without a token or with an invalid token are treated as guest contexts rather than being rejected. This allows unauthorized access to sensitive data through the following API endpoints:
  • '/api/project'
  • '/api/alarms'
  • '/api/scheduler'
The issue originates in the verifyToken() function within server/api/jwt-helper.js, which converts missing or invalid tokens into a guest context. This leads to the disclosure of project metadata, alarms, and scheduler information.
Recommendations For version 1.3.0-2773, restrict access to the '/api/project', '/api/alarms', and '/api/scheduler' endpoints until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Improper Authentication

Weakness Enumeration

CWE-862CWE-287

Related Identifiers

CVE-2026-47718
GHSA-R9G5-7Q8J-958C

Affected Products

Fuxa