---
id: CVE-2026-47721
title: FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software
summary: >-
  FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.
  Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler in
  server/api/scheduler/index.js do not consistently enforce
  authJwt.haveAdminPermission for schedule…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-862
vendor: fuxa-server
product: fuxa-server
affected:
  - fuxa-server <= 1.1.14-1243
published: '2026-08-18'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:13:25.910'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-47721'
references:
  - url: >-
      https://github.com/frangoteam/FUXA/commit/3c945a03f9942fd45a793ab7e3c2d1f1b15b93bf
    label: security-advisories@github.com
  - url: 'https://github.com/frangoteam/FUXA/pull/2345'
    label: security-advisories@github.com
  - url: 'https://github.com/frangoteam/FUXA/releases/tag/v1.3.2'
    label: security-advisories@github.com
  - url: 'https://github.com/frangoteam/FUXA/security/advisories/GHSA-8ghr-w65f-j3qr'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-8ghr-w65f-j3qr'
tags:
  - nvd
  - ghsa
  - npm
epss: 0.00434
epssPercentile: 0.35012
aliases:
  - GHSA-8ghr-w65f-j3qr
ecosystem: npm
ingestedAt: '2026-07-07T15:41:59.834Z'
---

## Overview

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler in server/api/scheduler/index.js do not consistently enforce authJwt.haveAdminPermission for scheduler settings. An authenticated non-admin operator can create or alter deviceActions that invoke onSetValue or onRunScript, or delete schedules, gaining access to device-value changes and server-side project script execution normally reserved for administrators. Scheduled and repeating actions can continue changing PLC setpoints, safety interlocks, device state, or project data after the operator's session ends. This issue is fixed in version 1.3.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-47721)

Affected packages:

- `fuxa-server <= 1.1.14-1243`

Source: https://github.com/advisories/GHSA-8ghr-w65f-j3qr