Missing authentication for destructive operations in FOGProject fogproject (CVE-2026-47688)

The `clearAES` and `clearPMTasks` methods in `FOGPage` can be invoked by an unauthenticated attacker via a single HTTP GET request through the public `client` node endpoint. `clearAES` wipes host AES encryption credentials (breaking FOG Client communication and forcing re-enrollment), while `clearPMTasks` deletes all power management scheduled tasks for every host in a targeted group. No login, session, or CSRF token is required to trigger either action. Affected versions: - < 1.5.10.1832 - < 1.6.0-beta.2313 We recommend updating to: 1.5.10.1832, 1.6.0-beta.2313. CVSS 8.2 · our assessment: this_week Reference: https://github.com/FOGProject/fogproject/security/advisories/GHSA-95pr-mcrf-x2qg Details: https://vuln.today/cve/CVE-2026-47688