FUXA’s secure mode is intended to restrict API access to authenticated users. However, versions prior to 1.3.1 still allow requests with no authentication or with an invalid token to reach read‑only project, alarm, and scheduler endpoints. This represents an authentication bypass (CWE‑287) and an authorization failure (CWE‑862), enabling an attacker to obtain potentially sensitive operational data.

The affected product is frangoteam FUXA, specifically releases 1.3.0‑2773 and earlier that include the secureEnabled=true option. Versions 1.3.1 and later incorporate the fix that enforces proper token validation.

The CVSS score of 5.5 indicates medium severity. No EPSS score is available, so the likelihood of exploitation cannot be quantified from the data, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need web access to the FUXA instance; the likely vector is remote via exposed HTTP/HTTPS APIs. Successful exploitation would allow arbitrary read of protected project data, alarms, and scheduler configurations, which may reveal operational insights or aid further attacks.