CVE-2026-47717: 
JavaScript vulnerability analysis and mitigation

CVE-2026-47717 is an unauthenticated project data disclosure vulnerability in FUXA, a web-based SCADA/HMI/Dashboard software developed by frangoteam. The GET /api/project endpoint exposes sensitive project configuration data to unauthenticated (guest-context) requests even when the secureEnabled security setting is active. Only fuxa-server version 1.3.0 (npm package) is affected; version 1.3.1 resolves the issue. The vulnerability was published on May 26–27, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, FUXA Security Advisory).

The root cause is classified as CWE-201 (Insertion of Sensitive Information Into Sent Data). The GET /api/project endpoint in server/api/projects/index.js applies the secureFnc middleware, but the underlying verifyToken function in server/api/jwt-helper.js automatically generates a valid guest JWT when no token is provided (lines 49–51: if (!token) { token = getGuestToken(); }). This guest token is signed with the server's own secret and passes verification, granting the request access to the full project data. Although the _filterProjectPermission function filters some UI elements for non-admin users, it does not strip scripts, device configurations, alarms, or other sensitive data from the response (GitHub Advisory, FUXA Security Advisory).

Successful exploitation allows any unauthenticated network attacker to retrieve the full FUXA project configuration, including server-side script source code (with IDs, names, execution modes, and permission levels), device connection and communication endpoint details, complete HMI operator screen layouts (SVG content with variable-to-device-tag bindings), and alarm thresholds and notification settings. In industrial (OT/ICS) environments, this intelligence can be used to map the system architecture, identify exploitable automation logic, and plan targeted follow-on attacks against connected industrial devices — significantly elevating the risk beyond simple data exposure (GitHub Advisory).

The vulnerability is trivially exploitable with no authentication, no special privileges, and no user interaction required, making it fully automatable. A public proof-of-concept (PoC) is included in the GitHub security advisory, consisting of a single curl command. NVD SSVC data classifies exploitation as "poc" and automatable. The EPSS score is approximately 1.2% (66th percentile), indicating moderate near-term exploitation probability. A Nuclei detection template was added to the ProjectDiscovery nuclei-templates repository (v10.4.5 release), further lowering the barrier for mass scanning. No in-the-wild exploitation or threat actor attribution has been reported as of the time of this report (GitHub Advisory, Nuclei Templates).

1. Reconnaissance: Identify internet-facing or network-accessible FUXA instances running version 1.3.0 using Shodan, Censys, or mass scanning tools targeting the default port (1881).
2. Confirm vulnerability: Send an unauthenticated HTTP GET request to the /api/project endpoint: curl -s http://<target>:1881/api/project.
3. Receive sensitive data: The server auto-generates a guest JWT internally and returns the full project JSON, including server-side script source code, device configurations, HMI layouts, and alarm definitions — all without any supplied credentials.
4. Analyze and exploit: Parse the returned data to map the industrial system architecture, extract device communication endpoints, and review automation scripts for exploitable logic or credentials that can be leveraged in follow-on attacks against connected OT/ICS devices (GitHub Advisory, FUXA Security Advisory).

• Network: Unauthenticated HTTP GET requests to /api/project on port 1881 (or configured FUXA port) with no Authorization header or session cookie; high-frequency or automated requests to this endpoint from external or unexpected IP addresses.
• Logs: FUXA server access logs showing repeated GET /api/project requests returning HTTP 200 responses from unauthenticated clients; absence of a JWT Authorization header in requests that successfully retrieve project data.
• Process/Application: Nuclei scanner user-agent strings or other automated scanning tool signatures in HTTP request logs targeting the /api/project endpoint.

The primary remediation is to upgrade fuxa-server to version 1.3.1 or later, which fixes the authentication bypass by correcting the guest token auto-generation behavior and removing script properties from the frontend project response. The v1.3.1 release also addresses several related security issues including authentication bypass in request routing logic and authorization validation for other API endpoints. As an interim workaround, restrict network access to the FUXA server (port 1881) using firewall rules to allow only trusted hosts, and avoid exposing FUXA instances directly to the internet (FUXA Release v1.3.1, GitHub Advisory).

Security researcher AbdrrahimDahmani was credited with discovering and reporting the vulnerability. A technical write-up was published by Deniz Halil on June 19, 2026, covering the FUXA SCADA data disclosure issue. The vulnerability received coverage from multiple vulnerability intelligence platforms and was incorporated into the ProjectDiscovery Nuclei templates (v10.4.5), reflecting community interest in automated detection for SCADA/ICS-facing software (Deniz Halil Blog, Nuclei Templates).