EUVD-2026-351929

fkie_cve-2026-47717

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixes the issue.

GHSA-q3w6-q3hc-c5x6 — FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations

Affected: npm: fuxa-server

### Summary

The GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled.

### Details

File: `server/api/projects/index.js`

```javascript prjApp.get("/api/project", secureFnc, function(req, res) { const permission = checkGroupsFnc(req); runtime.project.getProject(req.userId, permission).then(result => { if (result) { res.json(result); } }); }); ```

The endpoint uses the `secureFnc` middleware, but this middleware calls `verifyToken` in `server/api/jwt-helper.js` which auto-generates a valid guest JWT when no token is provided (line 49-51):

```javascript if (!token) { token = getGuestToken(); } ```

The guest token is signed with the server's secret and passes verification. The handler then calls `getProject` which returns the full project data. The `_filterProjectPermission` function (line 924 of `server/runtime/project/index.js`) filters some UI elements for non-admin users, but it does not remove scripts, devices, alarms, or other sensitive configuration data.

### PoC

**Environment**

- FUXA v1.3.0-2773 (`frangoteam/fuxa:latest`) - `secureEnabled: true` with a random `secretCode`

**Retrieve full project data without authentication:**

```bash curl -s http://192.168.32.129:1881/api/project ```

```json { "scripts": [ { "id": "SCRIPT_ID", "name": "calculate" }, ] } ```

No authentication token, API key, or cookie was provided.…

Most recent entries from all

EUVD-2026-351929

fkie_cve-2026-47717

GHSA-q3w6-q3hc-c5x6 — FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations