CVE-2026-47718: FUXA Server Allows Unauthorized Access to Protected APIs in Secure Mode
Summary
CVE-2026-47718: FUXA provides guest and invalid-token access to protected read APIs in secure mode. Affects fuxa-server versions >= 1.3.0-2773, < 1.3.1. Fixed in 1.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FUXA is an open-source server application designed to manage projects, alarms, and scheduling functionalities. It aims to provide a secure environment for users, particularly in scenarios where sensitive data is handled. However, a vulnerability in version 1.3.0-2773 allows unauthorized access to protected read APIs even when secure mode is enabled, undermining its security features.
Vulnerability Detail
The vulnerability arises from the improper handling of authentication tokens in FUXA version 1.3.0-2773. When secure mode is enabled (secureEnabled=true), the server still permits guest users and requests with invalid tokens to access sensitive APIs, such as project, alarms, and scheduler endpoints. This flaw can lead to unauthorized disclosure of project metadata, alarms, and scheduling information, potentially aiding attackers in reconnaissance and follow-on attacks.
How To Fix
Latest published version: 1.1.14-1243 as of 23 Oct 2026
npm install fuxa-server@1.1.14-1243Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.1
This is the first release that contains the fix.
npm install fuxa-server@1.3.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional checks in your API endpoints to reject requests with missing or invalid tokens, ensuring that only authenticated users can access sensitive data. For example, modify your API handlers to include token validation logic before processing requests.
Conclusion
The vulnerability identified as CVE-2026-47718 in FUXA server version 1.3.0-2773 allows unauthorized access to protected APIs even when secure mode is enabled. It is crucial for users to update to version 1.3.1 or later to mitigate this risk and protect sensitive data.
See every vulnerability recorded for fuxa-server →
FAQ
The vulnerability allows unauthorized access to sensitive project, alarms, and scheduler data, which can lead to data breaches and assist attackers in planning further attacks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update, implement additional authentication checks in your API to restrict access to sensitive endpoints.
'secureEnabled=true' is a configuration setting in FUXA that is intended to enforce security measures, but due to this vulnerability, it does not function as expected.
The CVSS score for this vulnerability is 5.5, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for fuxa-server.
