CVE-2026-47718
CVE-2026-47718 · FUXA provides guest and invalid-token access to protected read APIs in secure mode
This page contains facts from public vulnerability sources. Check the original advisory before updating.
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue.
CVSS 5.5 · Medium · EPSS 0.5% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
fuxa
- Versions
- = 1.3.0-2773: Affected
No fix published
fuxa-server npm
- Versions
- 1.3.0-2773
- Affected ranges
- SEMVER: ≥ 1.3.0-2773, < 1.3.1
Update to 1.3.1