FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations

Description

The GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled.

Recommendation

Update the fuxa-server package to the latest compatible version. Followings are version details:

• Affected version(s): = 1.3.0
• Patched version(s): 1.3.1

References

• GHSA-q3w6-q3hc-c5x6
• CVE-2026-47717
• CWE-201
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• FUXA Unauthenticated Remote Arbitrary Device Tag Write - CVE-2026-25752
• FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue - CVE-2026-43946
• FUXA Unauthenticated Remote Code Execution via Admin JWT Minting - CVE-2026-25893
• FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration - CVE-2026-25894

You might also like:

Exploiting Server Version Disclosure

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

fuxa-server