CVE-2026-67443

Name of the Vulnerable Software and Affected Versions FUXA versions prior to 1.3.3

Description An authorization bypass exists in the allowDashboard gate within server/integrations/node-red/index.js where authJwt.verify is called for the /nodered endpoint without inspecting the decoded identity. When nodeRedEnabled, secureEnabled, and nodeRedAuthMode are set to secure, a remote unauthenticated attacker can obtain a signed guest token via the POST /api/heartbeat endpoint to access the RED.httpAdmin editor and flow deployment API. Due to the absence of a second adminAuth gate in the Node-RED configuration, an attacker can deploy function nodes or invoke the fuxa.runScript() and runtime.scriptsMgr.runScript() functions. This allows unauthorized control over project data, configuration, scripts, and filesystem-capable runtime helpers, potentially leading to the execution of operating-system commands if nodeRedUnsafeModules is enabled.

Recommendations Update to version 1.3.3.