CVE-2026-47718
published 2026-08-12CVE-2026-47718: FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token…
PriorityP334medium5.5CVSS 4.0
AVNACLATNPRNUINVCLVILVANSCNSINSANEPCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.34%
27.9th percentile
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| frangoteam | fuxa | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
frangoteam FUXA 1.3.0-2773 privileges management
vuldb·2026-08-13·CVSS 5.5
CVE-2026-47718 [MEDIUM] frangoteam FUXA 1.3.0-2773 privileges management
A vulnerability described as problematic has been identified in frangoteam FUXA 1.3.0-2773. This impacts an unknown function. The manipulation results in improper privilege management.
This vulnerability is known as CVE-2026-47718. It is possible to launch the attack remotely. No exploit is available.
Upgrading the affected component is recommended.
GHSA
FUXA provides guest and invalid-token access to protected read APIs in secure mode
ghsa·2026-05-28
CVE-2026-47718 [MEDIUM] CWE-287 FUXA provides guest and invalid-token access to protected read APIs in secure mode
FUXA provides guest and invalid-token access to protected read APIs in secure mode
### Summary
When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs.
### Details
In secure mode, requests with no token or an explicitly invalid token were still able to access protected read endpoints.
Confirmed behavior:
- guest `GET /api/project` returned `200 OK`
- invalid-token requests to `/api/project` also returned successful responses containing project data
- guest and invalid-token requests also returned `200 OK` on:
- `/api/alarms`
- `/api/scheduler`
Relevant code paths identified during analysis:
- `server/api/jwt-helper.js`
- `verifyToken()` converts missing-token or invalid-token states into guest context in
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-12
Published