{"action":"Upgrade fuxa-server to 1.3.1 or later.","affected":[{"fixed":"1.3.1","introduced":"1.3.0-2773"}],"component":"fuxa-server","cve_ids":["CVE-2026-47718"],"ecosystem":"npm","epss":0.00458,"exploited":false,"fixed_versions":["1.3.1"],"ghsa_id":"GHSA-r9g5-7q8j-958c","id":"tcs_01M5KG8MMVK9046FXMJP7YH8R6","modified_at":"2026-05-28T20:56:25.620310Z","published_at":"2026-05-28T20:33:11Z","references":["https://osv.dev/vulnerability/GHSA-r9g5-7q8j-958c","https://github.com/frangoteam/FUXA/security/advisories/GHSA-r9g5-7q8j-958c","https://github.com/frangoteam/FUXA","https://github.com/frangoteam/FUXA/releases/tag/v1.3.1"],"severity":{"label":"medium","score":5.5},"sources":[{"source":"osv","source_id":"GHSA-r9g5-7q8j-958c","url":"https://osv.dev/vulnerability/GHSA-r9g5-7q8j-958c"},{"source":"nvd","source_id":"CVE-2026-47718","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47718"}],"summary":"FUXA provides guest and invalid-token access to protected read APIs in secure mode"}