CVE-2026-47721: FUXA Auth Bypass Vulnerability

CVE-2026-47721 Overview

CVE-2026-47721 is a missing authorization vulnerability [CWE-862] in FUXA, a web-based Process Visualization (SCADA/HMI/Dashboard) platform. Versions prior to 1.3.2 fail to consistently enforce authJwt.haveAdminPermission on the POST /api/scheduler and DELETE /api/scheduler endpoints in server/api/scheduler/index.js. An authenticated non-admin operator can create, modify, or delete scheduler entries that invoke onSetValue or onRunScript device actions. This grants indirect access to PLC setpoint changes and server-side project script execution normally reserved for administrators. The issue is fixed in version 1.3.2.

Critical Impact
Non-admin operators can plant scheduled actions that continue changing PLC setpoints, safety interlocks, device state, or project data after their session ends.

Affected Products

FUXA versions prior to 1.3.2
FUXA SCADA/HMI/Dashboard server component (server/api/scheduler/index.js)
Deployments exposing the FUXA scheduler API to authenticated non-admin operator accounts

Discovery Timeline

2026-08-18 - CVE-2026-47721 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-47721

Vulnerability Analysis

FUXA exposes scheduler management through REST endpoints in server/api/scheduler/index.js. The POST /api/scheduler handler creates or updates scheduler entries, while DELETE /api/scheduler removes them. Both handlers verified an authenticated JWT token and rejected guest users, but they did not consistently check administrator group membership via authJwt.haveAdminPermission.

Because of this gap, any authenticated operator account could submit scheduler entries containing deviceActions that call onSetValue (writing tags to devices such as PLCs) or onRunScript (executing server-side project scripts). Scheduled tasks run under the application's context and persist beyond the creator's session, so a malicious operator can plant recurring actions that continue to modify device state, safety interlocks, or project data long after logout.

Root Cause

The root cause is missing authorization enforcement on privileged scheduler routes. The handlers evaluated authentication (isGuestUser) but omitted the administrator role check, treating operator-level tokens as sufficient for scheduler mutation. This is a classic [CWE-862] missing authorization flaw on a sensitive control plane.

Attack Vector

An attacker requires a valid non-admin operator account and network reachability to the FUXA API. The attacker sends a crafted POST /api/scheduler request that defines a deviceAction invoking onSetValue or onRunScript, or issues DELETE /api/scheduler to remove existing schedules. The scheduler executes the payload at its configured trigger, granting indirect device and script-execution privileges.

javascript

// Patch from server/api/scheduler/index.js (v1.3.2)
// Adds administrator permission check before allowing scheduler mutation
            runtime.logger.error("api post scheduler: Tocken Expired");
            return;
        }
+       const permission = checkGroupsFnc(req);
        const isGuest = authJwt.isGuestUser(req.userId, req.userGroups);
+       const isAdmin = authJwt.haveAdminPermission(permission);
        if (runtime.settings?.secureEnabled && isGuest) {
            res.status(401).json({error:"unauthorized_error", message: "Unauthorized!"});
            runtime.logger.error("api post scheduler: Unauthorized guest");

Source: FUXA commit 3c945a03

Detection Methods for CVE-2026-47721

Indicators of Compromise

Unexpected POST /api/scheduler or DELETE /api/scheduler requests originating from non-admin user sessions.
New scheduler entries containing onSetValue or onRunScript device actions that were not created by an administrator.
Unexplained PLC setpoint changes, tag writes, or safety interlock toggles correlating with scheduler trigger times.
Project script executions logged outside of documented administrative change windows.

Detection Strategies

Audit application logs for scheduler API calls and correlate the authenticated user ID against the administrator group roster.
Baseline the current set of scheduler entries and alert on additions, deletions, or modifications performed by non-admin accounts.
Inspect FUXA runtime logs for onRunScript invocations and match them to authorized change tickets.

Monitoring Recommendations

Forward FUXA API access logs and runtime logs to a centralized SIEM for correlation with PLC and device telemetry.
Alert on any HTTP method other than GET against /api/scheduler from operator-tier accounts.
Monitor OT network traffic for unexpected tag writes that align with FUXA scheduler intervals.

How to Mitigate CVE-2026-47721

Immediate Actions Required

Upgrade FUXA to version 1.3.2 or later, which introduces the haveAdminPermission check on scheduler mutation endpoints.
Review existing scheduler entries and remove any deviceActions or scripts that cannot be attributed to an authorized administrator.
Rotate credentials for operator accounts that may have been used to abuse the scheduler API.

Patch Information

The fix is available in FUXA Release v1.3.2 and merged via Pull Request #2345. Full technical context is documented in GitHub Security Advisory GHSA-8ghr-w65f-j3qr.

Workarounds

Restrict network access to the FUXA API so only administrator workstations can reach /api/scheduler endpoints, using a reverse proxy or firewall ACL.
Temporarily disable non-admin operator accounts on FUXA instances until the upgrade to 1.3.2 is complete.
Enable and review runtime.settings.secureEnabled to ensure guest access is blocked at minimum, while treating operator accounts as untrusted for scheduler operations.

bash

# Example: block non-admin access to scheduler endpoints at a reverse proxy (nginx)
location ~ ^/api/scheduler$ {
    if ($request_method ~ ^(POST|DELETE)$) {
        # Allow only requests from admin management subnet
        allow 10.10.20.0/24;
        deny all;
    }
    proxy_pass http://fuxa_backend;
}