CVE-2026-47719 is a Server-Side Request Forgery (SSRF) vulnerability in frangoteam's FUXA software prior to version 1.3.2. The vulnerability exists because the DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY Socket.IO handlers in server/runtime/index.js do not verify if the socket write is authorized and accept attacker-controlled property.address or endpoint connection data. This enables a remote unauthenticated attacker to trigger axios.get calls to arbitrary HTTP or HTTPS endpoints, including OPC UA or ODBC services reachable from the FUXA host. The attacker can receive the results through the corresponding Socket.IO event, effectively using the server as an SSRF oracle. This can lead to exposure of cloud instance metadata, internal administrative services, industrial endpoints, and ODBC data, even when secureEnabled is true. The vulnerability is resolved in version 1.3.2.

An unauthenticated remote attacker can exploit this SSRF vulnerability to make the FUXA server perform arbitrary HTTP or HTTPS requests to internal or external systems accessible from the host. This can lead to unauthorized disclosure of sensitive information such as cloud instance metadata, internal administrative services, industrial control endpoints, and ODBC database data. The vulnerability has a high severity with a CVSS score of 8.2, indicating a significant confidentiality impact but limited integrity and no availability impact.

Upgrade FUXA to version 1.3.2 or later, where this SSRF vulnerability is fixed. No official patch or temporary fix is indicated other than upgrading. Until the upgrade is applied, restrict network access to the FUXA server to limit exposure to internal services that could be targeted via SSRF.