CVE-2026-47717

Name of the Vulnerable Software and Affected Versions fuxa-server version 1.3.0

Description FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A logic flaw in the API allows unauthenticated guest-context requests to access sensitive project configuration data via the 'GET /api/project' endpoint, even when the secureEnabled setting is active. This occurs because the secureFnc middleware automatically generates a valid guest JWT when no token is provided, and the subsequent getProject() function fails to remove critical data for non-admin users. Exposed information may include full source code of server-side scripts, device configurations and communication endpoints, HMI views with SVG content and variable bindings, and alarm definitions including thresholds and conditions. In industrial environments, this disclosure of internal automation logic and system structure can facilitate further targeted attacks.

Recommendations Update fuxa-server to version 1.3.1. As a temporary workaround, restrict access to the 'GET /api/project' endpoint to minimize the risk of exploitation.