CVE-2026-42949: Medium severity FUXA FUXA vulnerability
A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to execute priviledged operation. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can trigger the issue by sending a specially crafted HTTP request to the affected endpoint. No user interaction or prior privileges are required.
What access or configuration is needed for exploitation?
The vulnerable /api/runscript functionality must be reachable over HTTP. The supplied data does not identify any additional configuration prerequisite.
What impact can successful exploitation have?
Successful exploitation can cause a privileged operation to be executed. The reported impact includes low confidentiality, integrity, and availability effects.