Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
frangoteam/FUXA
master @ 3616aab
37
Fixes
0
CVEs
CRITICAL
Peak severity
40.0%
Coverage
Highlights
Auth Bypass: 22 prior fixes. Scrutinize any change in this area.
server/api/index.js: most-fixed (7 issues). Treat as high-risk during review.
34 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Multiple socket events (device property read, web API request, device value set, enable) lacked write authorization, allowing guests/unauthenticated users to manipulate devices.
Authentication Bypass: Node-RED editor/admin routes were publicly accessible; fixes added JWT/API key checks, but one commit (1c33f47) reverted that, reintroducing the bypass. Node-RED is a high-value target for code execution.
Auth Bypass: Script execution authorization was bypassed via missing null checks on permission objects and empty role lists, and by binding execution to script name instead of id.