CVE-2026-47718

Name of the Vulnerable Software and Affected Versions FUXA version 1.3.0-2773

Description FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An authentication bypass exists when secureEnabled is set to true, allowing guests or users with invalid tokens to access protected read APIs. This occurs because the verifyToken() function in server/api/jwt-helper.js converts missing or invalid tokens into a guest context rather than rejecting the request. Consequently, the following API endpoints are accessible without valid authentication, leading to the disclosure of project metadata, alarms, and scheduler information:

Recommendations Update FUXA to version 1.3.1.