Vulnerability · Published Aug 18, 2026 · Assigned by GitHub_M

CVE-2026-47721FUXA: Scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions

Medium 6.3

In plain English

A medium-severity missing authorization in FUXA from frangoteam. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.4%top 62.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler in server/api/scheduler/index.js do not consistently enforce authJwt.haveAdminPermission for scheduler settings. An authenticated non-admin operator can create or alter deviceActions that invoke onSetValue or onRunScript, or delete schedules, gaining access to device-value changes and server-side project script execution normally reserved for administrators. Scheduled and repeating actions can continue changing PLC setpoints, safety interlocks, device state, or project data after the operator's session ends. This issue is fixed in version 1.3.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	fuxa-server	no fix listed	GHSA-8ghr-w65f-j3qr

Affected products (as reported)

Vendor	Product	Versions
frangoteam	FUXA	< 1.3.2

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

https://github.com/frangoteam/FUXA/security/advisories/GHSA-8ghr-w65f-j3qr x_refsource_CONFIRM
https://github.com/frangoteam/FUXA/pull/2345 x_refsource_MISC
https://github.com/frangoteam/FUXA/commit/3c945a03f9942fd45a793ab7e3c2d1f1b15b93bf x_refsource_MISC
https://github.com/frangoteam/FUXA/releases/tag/v1.3.2 x_refsource_MISC