CVE-2026-47721

The record

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler in server/api/scheduler/index.js do not consistently enforce authJwt.haveAdminPermission for scheduler settings. An authenticated non-admin operator can create or alter deviceActions that invoke onSetValue or onRunScript, or delete schedules, gaining access to device-value changes and server-side project script execution normally reserved for administrators. Scheduled and repeating actions can continue changing PLC setpoints, safety interlocks, device state, or project data after the operator's session ends. This issue is fixed in version 1.3.2.

Affected packages

Related vulnerabilities

• GHSA-8ghr-w65f-j3qr FUXA's scheduler API missing admin check enables operator-to-admin escalation via… Same vulnerability
• CVE-2026-47720 FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Also affects fuxa-server
• CVE-2026-47719 FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Also affects fuxa-server
• GHSA-h9fj-c2qr-76g2 FUXA has SQL Injection in its TDengine DAQ connector via backslash bypass of… Also affects fuxa-server
• GHSA-w86f-rf9w-h3x6 FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with… Also affects fuxa-server
• GHSA-r9g5-7q8j-958c FUXA provides guest and invalid-token access to protected read APIs in secure mode Also affects fuxa-server
• CVE-2026-47718 FUXA provides guest and invalid-token access to protected read APIs in secure mode Also affects fuxa-server
• GHSA-q3w6-q3hc-c5x6 FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device… Also affects fuxa-server