Joshua Hayes

**Name of the Vulnerable Software and Affected Versions** FUXA versions prior to 1.3.2 **Description** An authentication bypass exists in the REST API due to improper dot-segment path normalization. The API router does not normalize dot-segment sequences before the authentication middleware is applied. This allows unauthenticated users to access protected endpoints by prefixing paths with dot-segments, such as '/api/./users', '/api/./roles', and '/api/project/../users', resulting in the unauthorized disclosure of sensitive user and role data. **Recommendations** Update FUXA to version 1.3.2 or later.