{"cve":"CVE-2026-47721","nvd":{"published":"2026-08-18T20:17:15.383","modified":"2026-10-22T22:10:00.250","status":"Deferred","description":"FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler in server/api/scheduler/index.js do not consistently enforce authJwt.haveAdminPermission for scheduler settings. An authenticated non-admin operator can create or alter deviceActions that invoke onSetValue or onRunScript, or delete schedules, gaining access to device-value changes and server-side project script execution normally reserved for administrators. Scheduled and repeating actions can continue changing PLC setpoints, safety interlocks, device state, or project data after the operator's session ends. This issue is fixed in version 1.3.2.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","score":6.3},"cwes":["CWE-862"],"references":["https://github.com/frangoteam/FUXA/commit/3c945a03f9942fd45a793ab7e3c2d1f1b15b93bf","https://github.com/frangoteam/FUXA/pull/2345","https://github.com/frangoteam/FUXA/releases/tag/v1.3.2","https://github.com/frangoteam/FUXA/security/advisories/GHSA-8ghr-w65f-j3qr"],"products":[],"source":"nvd","synced_at":"2026-10-23T16:39:26.291718493+00:00"},"epss":{"cve":"CVE-2026-47721","score":0.00434,"percentile":0.37473,"date":"2026-10-26"},"kev":null,"osv":[{"id":"GHSA-8ghr-w65f-j3qr","url":"https://osv.dev/vulnerability/GHSA-8ghr-w65f-j3qr","summary":"FUXA's scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions","modified":"2026-06-08T23:26:35.850398Z","packages":[{"ecosystem":"npm","name":"fuxa-server","purl":"pkg:npm/fuxa-server","ranges":["<=1.1.14-1243"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}