medium5.5
CVE-2026-47718
FUXA provides guest and invalid-token access to protected read APIs in secure mode
Impact
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | fuxa-server | = 1.3.0-2773 | 1.3.1 |