FUXA CVE-2026-47717
HIGH
GHSA-q3w6-q3hc-c5x6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach FUXA web port (1881)
-
DeliverySend GET /api/project unauthenticated
-
ExploitGuest JWT auto-issued, passes verification
-
ExecutionReceive full project JSON
-
PersistHarvest scripts, devices, HMI tags, alarms
-
ImpactPlan targeted ICS attack
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Outbound data filtering
|
| Exploitation Conditions | Exploitation requires only network reachability to the FUXA HTTP endpoint and a GET request to /api/project; no token, API key, or cookie is needed (PR:N). The condition that makes this notable is that it occurs specifically when secureEnabled is set to true with a configured secretCode - the deployment believes it is in secured mode, yet the secureFnc/verifyToken middleware auto-issues a valid guest JWT (getGuestToken) for tokenless requests, so authentication is effectively bypassed. Limiting factors that reduce realistic risk: the target FUXA instance must be version 1.3.0 and network-reachable by the attacker (e.g., not isolated on a segregated OT network behind authenticating proxies/ACLs), and the value of what is leaked depends on the deployed project - device/endpoint and alarm exposure only appear if those are configured, while scripts and HMI views are exposed by default when present. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) and the description are fully consistent: a network-reachable endpoint, no authentication (PR:N), no user interaction, and high confidentiality impact with no integrity or availability effect - this is purely a disclosure issue, not RCE. Publicly available exploit code exists in the form of the trivial unauthenticated curl PoC, which raises practical risk because exploitation requires no skill or tooling. No EPSS score was provided, so exploitation-probability cannot be quantified here, and the vulnerability is not listed in CISA KEV, so there is no confirmation of active in-the-wild exploitation. No SSVC decision data was supplied; however, the technical-impact ceiling is bounded to information disclosure rather than full system compromise. Real-world priority is elevated for internet-exposed or flat-network ICS deployments because leaked scripts and device/endpoint details materially aid follow-on targeted attacks; for FUXA instances confined to an isolated OT segment, the disclosure-only nature lowers urgency relative to the raw 7.5 score. |
| Exploit ScenarioDerived | An attacker who can reach the FUXA web port (1881) over the network sends a single unauthenticated GET request to /api/project, as shown in the public PoC (curl -s http://target:1881/api/project), and receives the full project JSON despite secureEnabled being on. They harvest server-side script source code, device communication endpoints, HMI tag bindings, and alarm thresholds, then use that reconnaissance to plan targeted attacks against the underlying industrial devices and automation logic. Given AV:N/AC:L/PR:N/UI:N, the attack is a one-step, no-authentication request requiring only network reachability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 27, 2026
Unauthenticated information disclosure in FUXA 1.3.0 (web-based SCADA/HMI server, npm package fuxa-server) lets remote attackers retrieve full project configuration from the GET /api/project endpoint even when secureEnabled is turned on. The exposed data includes server-side script source code, device connection details, HMI view layouts with tag bindings, and alarm definitions. Publicly available exploit code exists (a single unauthenticated curl request demonstrated in the GitHub advisory), and the CVSS vector confirms unauthenticated network exploitation rated 7.5 (confidentiality-only impact); there is no public exploit identified as actively exploited in CISA KEV.
RemediationAI
Vendor-released patch: upgrade to FUXA v1.3.1, which the release notes confirm addresses this class of issue (including 'Security: remove script property of frontend project', authentication-bypass fixes in request routing #2260, and related authorization fixes); pull the patched image or release from https://github.com/frangoteam/FUXA/releases/tag/v1.3.1 and review the advisory at https://github.com/frangoteam/FUXA/security/advisories/GHSA-q3w6-q3hc-c5x6. Until you can upgrade, place FUXA behind a reverse proxy or network ACL that requires real authentication and blocks unauthenticated access to /api/project - the side effect is that any legitimate guest/anonymous dashboard access also breaks. Additionally, restrict the FUXA HTTP port (default 1881) to a trusted OT management segment or VPN rather than exposing it to general networks, accepting that remote operators will then need VPN access; rotating the secretCode does not mitigate this because the guest token is signed with that same secret, so secret rotation alone is not a valid workaround.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
FUXA is a Node.js-based SCADA/HMI and IIoT platform used to build operator dashboards and connect to industrial devices (Modbus, S7, OPC-UA, etc.). The flaw maps to CWE-201 (Insertion of Sensitive Information Into Sent Data): the /api/project route is wrapped by the secureFnc middleware, but secureFnc delegates to verifyToken in server/api/jwt-helper.js, which on a missing token silently substitutes a guest JWT via getGuestToken() (jwt-helper.js lines 49-51). That guest token is signed with the server's own secret, so it passes signature verification and the handler proceeds as an authenticated guest. The getProject implementation then returns the project, and the _filterProjectPermission routine (server/runtime/project/index.js line 924) only strips selected UI elements for non-admin users - it never removes scripts, devices, alarms, or other sensitive configuration - so guest-context callers receive the complete project. The only affected package per the provided data is pkg:npm/fuxa-server.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (https://github.com/frangoteam/FUXA) · only source for this CVE.
CVSS VectorVendor: https://github.com/frangoteam/FUXA
DescriptionCVE.org
Summary
The GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled.
Details
File: server/api/projects/index.js
prjApp.get("/api/project", secureFnc, function(req, res) {
const permission = checkGroupsFnc(req);
runtime.project.getProject(req.userId, permission).then(result => {
if (result) {
res.json(result);
}
});
});The endpoint uses the secureFnc middleware, but this middleware calls verifyToken in server/api/jwt-helper.js which auto-generates a valid guest JWT when no token is provided (line 49-51):
if (!token) {
token = getGuestToken();
}The guest token is signed with the server's secret and passes verification. The handler then calls getProject which returns the full project data. The _filterProjectPermission function (line 924 of server/runtime/project/index.js) filters some UI elements for non-admin users, but it does not remove scripts, devices, alarms, or other sensitive configuration data.
PoC
Environment
- FUXA v1.3.0-2773 (
frangoteam/fuxa:latest) secureEnabled: truewith a randomsecretCode
Retrieve full project data without authentication:
curl -s http://192.168.32.129:1881/api/project{
"scripts": [
{
"id": "SCRIPT_ID",
"name": "calculate"
},
]
}No authentication token, API key, or cookie was provided. The response includes:
- Server-side scripts: full source code, IDs, names, execution mode, and permission levels. This reveals internal automation logic and sensitive project structure information that could assist further attacks against the deployed system.
- Device configurations: and communication endpoint information may also be exposed depending on the deployed project configuration.
- HMI views: the full SVG content and layout of every operator screen, including variable bindings that map UI elements to device tags.
- Alarm definitions: alarm thresholds, conditions, and notification settings when configured.
Impact
The endpoint may expose sensitive project configuration data including script metadata, device connection information, HMI configuration, and alarm definitions. In industrial environments this information can assist further targeted attacks against the deployed system.
Executive ViewAI
FUXA 1.3.0 SCADA/HMI server contains an unauthenticated information disclosure vulnerability enabling remote attackers to download complete project configurations including source code, device credentials, and control system layouts via a single HTTP GET request. Organizations deploying fuxa-server face immediate exposure of sensitive industrial control system designs and operational data, with publicly available exploit code lowering attacker barriers significantly.
Restrict network access to /api/project endpoint via firewall/WAF to authorized IPs only; segment FUXA instances to isolated networks with minimal east-west traffic; disable public endpoint exposure if operationally feasible. Note: secureEnabled configuration setting does not prevent this vulnerability. Establish continuous monitoring of GitHub fuxa-server repository and vendor security channels for patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB