{"id":"EUVD-2026-57690","enisaUuid":"a7707747-3143-366e-838b-f54dff16cd77","description":"FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixes the issue.","datePublished":"Aug 12, 2026, 10:18:04 PM","dateUpdated":"Aug 13, 2026, 1:12:25 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/frangoteam/FUXA/security/advisories/GHSA-q3w6-q3hc-c5x6\nhttps://github.com/frangoteam/FUXA/releases/tag/v1.3.1\n","aliases":"CVE-2026-47717\nGHSA-q3w6-q3hc-c5x6\n","assigner":"GitHub_M","epss":1.38,"enisaIdProduct":[{"id":"427f2cca-591f-3663-aac8-09af8cf7795a","product":{"name":"FUXA","vendor":{"name":"frangoteam"}},"product_version":"\u003d 1.3.0"}],"enisaIdVendor":[{"id":"ae36e6ea-1143-3f25-a023-592f798d3f4f","vendor":{"name":"frangoteam"}}],"enisaIdVulnerability":[{"id":"55572775-b17d-3498-bd45-88a3e6f8e0cb","vulnerability":{"id":"CVE-2026-47717","description":"FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixes the issue.","datePublished":"Aug 12, 2026, 10:18:04 PM","dateUpdated":"Aug 13, 2026, 1:12:25 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/frangoteam/FUXA/security/advisories/GHSA-q3w6-q3hc-c5x6\nhttps://github.com/frangoteam/FUXA/releases/tag/v1.3.1\n","enisa_id":"EUVD-2026-57690\n","assigner":"GitHub_M","epss":1.38,"dataProcessed":"Nov 7, 2026, 7:22:05 AM","vulnerabilityProduct":[{"id":"6b598273-2b34-3094-9650-344c0dda59ed","product":{"name":"FUXA","vendor":{"name":"frangoteam"}},"product_version":"\u003d 1.3.0"}],"vulnerabilityVendor":[{"id":"a5115a92-f4b0-36a7-9b4e-1c5e269c9bf1","vendor":{"name":"frangoteam"}}]}},{"id":"64a1d9e2-bbc4-3880-821d-d49458510395","vulnerability":{"id":"GHSA-q3w6-q3hc-c5x6","description":"FUXA\u0027s Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations","datePublished":"May 27, 2026, 10:51:18 PM","dateUpdated":"May 27, 2026, 10:51:18 PM","baseScore":0.0,"references":"https://github.com/frangoteam/FUXA/security/advisories/GHSA-q3w6-q3hc-c5x6\nhttps://github.com/frangoteam/FUXA\nhttps://github.com/frangoteam/FUXA/releases/tag/v1.3.1\n","enisa_id":"EUVD-2026-57690\n","aliases":"GHSA-q3w6-q3hc-c5x6\nCVE-2026-47717\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:03 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}