CVE-2026-47717

FUXA's secureEnabled flag creates a false security promise. When you enable this toggle expecting it to gate all API access, /api/project remains publicly reachable without authentication — a bypass that undermines the entire security model operators rely upon. The critical insight here is that this isn't merely a missing auth check on one endpoint; it's a fundamental design failure in how authentication was implemented. When security is controlled by a boolean flag rather than enforced globally, every new route becomes a decision point: does this handler respect secureEnabled? Developers systematically fail such consistency checks, especially in SCADA/HMI environments where codebases often evolve through operator-contributed integrations without rigorous security review. The /api/project endpoint almost certainly predated the secureEnabled feature — added when FUXA was an internal or localhost tool, then left behind when authentication was grafted onto other routes. Your immediate actions: First, verify whether secureEnabled is enabled in your deployment — if it is, do not assume comprehensive protection. Second, audit every API endpoint in your FUXA instance under the assumption that secureEnabled may have been inconsistently applied; manually verify authentication is enforced on each route, particularly those handling project configuration, device connections, and tag mappings. Third, assume the exposed data (device parameters, tag mappings, alarm thresholds, operational logic) was publicly accessible during the disclosure window — treat any FUXA instance that was internet-facing during that window as potentially compromised. Fourth, monitor for unexpected access patterns in logs that might indicate reconnaissance or data exfiltration. The blast radius extends beyond this single endpoint. Discovering one bypass invalidates the mental model operators used when enabling secureEnabled. You now face an audit burden that requires source code access or significant reverse-engineering effort to complete comprehensively — most operators won't undertake this, which is exactly what an attacker will exploit. The SCADA/HMI context compounds the risk: exposed configuration data reveals not just what your system does, but how an attacker might manipulate physical processes. Assume recurrence is likely; toggle-based authentication systems consistently produce additional bypasses in subsequent releases.

Reviewed through automated stages and approved by a human before publication.