Description
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixes the issue.
Published: 2026-08-12
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability allows an attacker to retrieve sensitive project configuration information from the GET /api/project endpoint in FUXA server version 1.3.0. Even when the secureEnabled setting is enabled, the endpoint does not require authentication and returns data that may include server‑side scripts and device configurations. This exposes configuration secrets and operational data to unauthenticated users, constituting a significant confidentiality loss and matching CWE‑201.

Affected Systems

The affected product is FUXA, a web‑based process visualization platform by frangoteam. Version 1.3.0 includes the flaw. The issue was addressed in version 1.3.1, which removes the unauthenticated data exposure.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity with potential for substantial impact. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog, suggesting that it is not yet widely exploited. The likely attack vector is a simple unauthenticated HTTP GET request to the /api/project endpoint, requiring no special privileges and allowing an attacker to download sensitive information.

Generated by OpenCVE AI on August 13, 2026 at 01:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • FUXA to version 1.3.1 or newer to remove the vulnerability.
  • If upgrading is not feasible, reconfigure the server to restrict access to the /api/project endpoint for unauthenticated users, such as by disabling guest‑context calls or requiring authentication.
  • Implement network‑level controls that block or challenge unauthenticated access to the vulnerable endpoint, ensuring that only authorized traffic reaches the server.

Generated by OpenCVE AI on August 13, 2026 at 01:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-q3w6-q3hc-c5x6 FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations
History

Wed, 12 Aug 2026 23:30:00 +0000

Type Values Removed Values Added
First Time appeared Frangoteam
Frangoteam fuxa
Vendors & Products Frangoteam
Frangoteam fuxa

Wed, 12 Aug 2026 22:45:00 +0000

Type Values Removed Values Added
Description FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixes the issue.
Title FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations
Weaknesses CWE-201
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Frangoteam Fuxa
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-12T22:18:04.321Z

Reserved: 2026-05-19T21:29:25.482Z

Link: CVE-2026-47717

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-12T23:17:20.643

Modified: 2026-08-12T23:17:20.643

Link: CVE-2026-47717

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T02:00:13Z

Weaknesses
  • CWE-201

    Insertion of Sensitive Information Into Sent Data