CVE-2026-47718: Fuxa server FUXA Provides Guest And Invalid-token Vulnerability
MODERATECVE-2026-47718 is a MODERATE fuxa provides guest and invalid-token vulnerability (CWE-287: Improper Authentication) affecting Fuxa server libraries in the npm ecosystem. The issue involves fuxa provides guest and invalid-token access to protected read apis in secure mode. Remediation is available by upgrading affected packages to version 1.3.1.
CVE-2026-47718 at a Glance
How to Fix CVE-2026-47718
To remediate this vulnerability, upgrade all affected Fuxa server dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install fuxa-server@1.3.1Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls fuxa-serverHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2026-47718, inspect your project dependencies using npm:
npm ls fuxa-serverAnalyze the terminal output to locate any version of Fuxa server in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.3.1), your application is affected.
Note: The npm ls fuxa-server command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-287: Improper Authentication, where when an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. In Fuxa server, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-47718 Affected Fuxa server Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
fuxa-server
|
npm |
≥ 1.3.0-2773
< 1.3.1
All 1 versions
1.3.0-2773
|
1.3.1
|
References
Frequently Asked Questions
What is CVE-2026-47718?
Which Fuxa server versions are affected?
What version fixes CVE-2026-47718?
Is fuxa-server affected?
What CWE is associated with CVE-2026-47718?
How can I check npm dependencies for CVE-2026-47718?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-r9g5-7q8j-958c",
"modified" : "2026-05-28T20:33:11Z",
"published" : "2026-05-28T20:33:11Z",
"aliases" : [ "CVE-2026-47718" ],
"summary" : "FUXA provides guest and invalid-token access to protected read APIs in secure mode",
"details" : "### Summary\n\n When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs.\n\n ### Details\n\n In secure mode, requests with no token or an explicitly invalid token were still able to access protected read endpoints.\n\n Confirmed behavior:\n\n - guest `GET /api/project` returned `200 OK`\n - invalid-token requests to `/api/project` also returned successful responses containing project data\n - guest and invalid-token requests also returned `200 OK` on:\n - `/api/alarms`\n - `/api/scheduler`\n\n Relevant code paths identified during analysis:\n\n - `server/api/jwt-helper.js`\n - `verifyToken()` converts missing-token or invalid-token states into guest context instead of rejecting the request\n - `server/api/projects/index.js`\n - `server/api/alarms/index.js`\n - `server/api/scheduler/index.js`\n\n These handlers accepted the guest context and returned sensitive data in secure mode.\n\n ### PoC\n\n Tested only against isolated local lab instances under the original tester's control. No production, customer, shared, or third-party systems were involved.\n\n Reproduction:\n\n 1. Start FUXA `1.3.0-2773`.\n 2. Set `secureEnabled=true`.\n 3. Send unauthenticated requests to:\n - `GET /api/project`\n - `GET /api/alarms`\n - `GET /api/scheduler?id=test`\n 4. Observe `200 OK` responses.\n 5. Send the same requests with an explicitly invalid `x-access-token` value.\n 6. Observe the same successful responses.\n\n The exact HTTP requests and local PoC script used for confirmation can be provided upon request.\n\n ### Impact\n\n This is an authentication/authorization weakness in secure mode.\n\n Impact includes:\n\n - project metadata disclosure\n - alarms disclosure\n - scheduler information disclosure\n - assistance in reconnaissance/follow-on attacks\n\n Operators who believe secure mode protects these APIs are impacted.",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "fuxa-server"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "1.3.0-2773"
}, {
"fixed" : "1.3.1"
} ]
} ],
"versions" : [ "1.3.0-2773" ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/frangoteam/FUXA/security/advisories/GHSA-r9g5-7q8j-958c"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/frangoteam/FUXA"
}, {
"type" : "WEB",
"url" : "https://github.com/frangoteam/FUXA/releases/tag/v1.3.1"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-287", "CWE-862" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-05-28T20:33:11Z",
"nvd_published_at" : null
}
}