CVE-2026-47718

Received Received - Intake

FUXA Authentication Bypass in API Access

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: GitHub, Inc.

Description

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-47718

Affected Vendors & Products

Vendor	Product	Version / Range
fuxa	fuxa	From 1.3.0-2773 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

FUXA is a web-based Process Visualization software vulnerable in versions up to 1.3.0-2773. When secureEnabled is set to true, the software incorrectly allows guest and invalid-token requests to access sensitive APIs such as project, alarms, and scheduler endpoints.

Detection Guidance

Check if FUXA is running with `secureEnabled=true` and verify if guest or invalid-token requests can access restricted APIs like project, alarms, or scheduler endpoints. Monitor network traffic for unauthorized access attempts to these endpoints.

Impact Analysis

This vulnerability allows unauthorized users to read project data, alarms, and scheduler information without proper authentication. Attackers could exploit this to gather sensitive operational details or disrupt processes.

Mitigation Strategies

Upgrade FUXA to version 1.3.1 or later to fix the issue. If upgrading is not immediately possible, disable guest access and enforce strict token validation for all API requests.

Hi! I’m here to help you understand CVE-2026-47718. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70