CVE-2026-47718: 
JavaScript Analyse et atténuation des vulnérabilités

CVE-2026-47718 is an authentication bypass and missing authorization vulnerability in FUXA, an open-source web-based SCADA/HMI platform. When secureEnabled=true, FUXA version 1.3.0-2773 (npm package fuxa-server) still permits unauthenticated (guest) and explicitly invalid-token requests to access protected read APIs, including /api/project, /api/alarms, and /api/scheduler. The vulnerability was reported by researcher north-echo, published to the GitHub Advisory Database on May 28, 2026, and assigned GHSA-r9g5-7q8j-958c. It carries a CVSS v4.0 base score of 5.5 (Medium) (GitHub Advisory).

The root cause lies in server/api/jwt-helper.js, where the verifyToken() function incorrectly converts missing-token or invalid-token states into a guest context rather than rejecting the request outright (CWE-287: Improper Authentication, CWE-862: Missing Authorization). The API route handlers in server/api/projects/index.js, server/api/alarms/index.js, and server/api/scheduler/index.js then accept this guest context and return sensitive data without performing an additional authorization check. Exploitation requires no privileges, no user interaction, and no special attack conditions — an attacker simply sends an unauthenticated HTTP GET request or one with a fabricated x-access-token header to the affected endpoints. A PoC was confirmed against isolated lab instances and can be reproduced by starting FUXA with secureEnabled=true and issuing unauthenticated requests to the affected endpoints (GitHub Advisory, FUXA Security Advisory).

Successful exploitation allows any unauthenticated network attacker to read project metadata, alarm configurations, and scheduler information from a FUXA instance operating in secure mode. This information disclosure can facilitate reconnaissance and follow-on attacks against industrial control or SCADA environments where FUXA is deployed, potentially exposing operational technology (OT) asset details. Operators who rely on secureEnabled=true as a security boundary are directly impacted, as the setting provides a false sense of protection for these endpoints (GitHub Advisory, FUXA Security Advisory).

A proof-of-concept (PoC) exists and was confirmed by the reporter against isolated lab instances; the CVSS v4.0 exploit maturity is rated POC. No evidence of in-the-wild exploitation or threat actor attribution has been reported. The CVE status is currently listed as Reserved, and it does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is trivially exploitable — requiring only a standard HTTP client — against any internet- or network-exposed FUXA instance running version 1.3.0-2773 with secure mode enabled (GitHub Advisory).

1. Reconnaissance: Identify FUXA instances (version 1.3.0-2773) exposed on the network using tools like Shodan, Censys, or direct network scanning for the default FUXA port (typically TCP 1881).
2. Confirm secure mode: Attempt a guest request to /api/project — a 200 OK response with project data confirms the instance is vulnerable even if secureEnabled=true.
3. Unauthenticated data extraction: Send HTTP GET requests without any token to the protected endpoints:
   • GET /api/project — retrieves project metadata
   • GET /api/alarms — retrieves alarm configurations
   • GET /api/scheduler?id=test — retrieves scheduler information
4. Invalid-token bypass: Alternatively, include a fabricated or arbitrary value in the x-access-token HTTP header (e.g., x-access-token: invalidtoken123). The verifyToken() function will convert this to a guest context and the handlers will still return 200 OK with sensitive data.
5. Leverage disclosed data: Use the extracted project structure, alarm names, and scheduler details for further reconnaissance or to plan targeted follow-on attacks against the OT/SCADA environment (FUXA Security Advisory).

• Network: Repeated unauthenticated HTTP GET requests to /api/project, /api/alarms, or /api/scheduler from external or unexpected IP addresses; requests with absent or clearly invalid x-access-token header values returning 200 OK.
• Logs: FUXA server access logs showing GET /api/project, GET /api/alarms, or GET /api/scheduler with no Authorization/x-access-token header, or with a malformed token, resulting in HTTP 200 responses.
• Logs: Unusual volume or frequency of read requests to the above endpoints from a single source IP, suggesting automated enumeration or scraping of project/alarm/scheduler data.

The vulnerability is patched in FUXA version 1.3.1, which includes a fix for the authentication bypass in request routing logic (referenced as issue #2260 in the release notes). Operators should upgrade from fuxa-server npm package version 1.3.0-2773 to >= 1.3.1 immediately. As a temporary workaround prior to upgrading, restrict network access to the FUXA server using firewall rules or network segmentation to prevent untrusted clients from reaching the API endpoints (FUXA v1.3.1 Release, GitHub Advisory).