CVE-2026-47721
Received Received - Intake

FUXA 1.3.2 Auth Bypass in Scheduler API

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler in server/api/scheduler/index.js do not consistently enforce authJwt.haveAdminPermission for scheduler settings. An authenticated non-admin operator can create or alter deviceActions that invoke onSetValue or onRunScript, or delete schedules, gaining access to device-value changes and server-side project script execution normally reserved for administrators. Scheduled and repeating actions can continue changing PLC setpoints, safety interlocks, device state, or project data after the operator's session ends. This issue is fixed in version 1.3.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-19
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-47721

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
fuxa process_visualization to 1.3.2 (exc)
frangoteam fuxa to 1.3.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FUXA is a web-based SCADA/HMI/dashboard software. Versions before 1.3.2 have an authorization flaw in scheduler endpoints. POST and DELETE requests to /api/scheduler do not properly check admin permissions, allowing non-admin users to create, modify, or delete schedules. This enables unauthorized device actions like changing PLC values or running scripts.

Detection Guidance

Check FUXA server logs for unauthorized POST /api/scheduler or DELETE /api/scheduler requests. Inspect scheduler settings for unexpected deviceActions with onSetValue, onRunScript, or deletions. Verify admin permissions for all users with access to these endpoints.

Impact Analysis

An attacker with non-admin access could alter device settings, trigger unsafe operations, or execute malicious scripts. Even after logout, scheduled actions may continue running, potentially causing equipment damage, data corruption, or unauthorized system changes.

Compliance Impact

This vulnerability could violate compliance by allowing unauthorized access to sensitive systems. GDPR may be breached if personal data is exposed. HIPAA could be violated if protected health information is altered or accessed improperly. Unauthorized script execution may also breach integrity requirements.

Mitigation Strategies

Upgrade FUXA to version 1.3.2 or later. Review and restrict user permissions to ensure only admins can modify scheduler settings. Audit existing schedules and deviceActions for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47721. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart