{"id":"GHSA-8ghr-w65f-j3qr","revision":"64d8454db40b4508add0182489498bab","records":[{"revision":"64d8454db40b4508add0182489498bab","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-8ghr-w65f-j3qr","aliases":["CVE-2026-47721"],"title":"FUXA's scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions","description":"## Summary\n\nAn authorization issue in the Scheduler API allowed authenticated non-admin users to create or modify scheduled actions that should be restricted to administrators.\n\n## Details\n\nThe Scheduler API did not correctly enforce administrator permissions when processing scheduler modifications.\n\nAs a result, authenticated users with non-administrative roles could create or modify scheduled actions that execute privileged operations, including device value changes and server-side script execution.\n\nThe issue was fixed in version 1.3.2 by enforcing the appropriate permission checks for scheduler modifications.\n\n\n## Impact\n\nAn operator-level user in FUXA reaches the PLC-write and server-side-script-execution surface that the platform otherwise restricts to administrators. In a SCADA deployment those two privileges cover setpoint control and the automation scripting engine. Alice schedules a job that rewrites a pump's enable tag, opens a safety interlock, or runs a project script that walks the device tree. The scheduled-action model extends the attack: Alice does not need to keep a session open for the action to fire, and a repeating schedule re-applies her changes every cycle even if an admin reverts them manually.\n\n**CVSS 3.1**: `AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L` (Medium, 6.3). CWE-862.\n\n## Recommended Fix\n\nAdd `authJwt.haveAdminPermission(permission)` to both `POST /api/scheduler` and `DELETE /api/scheduler`, matching every other write endpoint that reaches `runtime.devices.setTagValue` or `runtime.scriptsMgr.runScript`.\n\n```javascript\nschedulerApp.post(\"/api/scheduler\", secureFnc, function(req, res) {\n    if (res.statusCode === 403) {\n        runtime.logger.error(\"api post scheduler: Tocken Expired\");\n        return;\n    }\n    const permission = checkGroupsFnc(req);\n    const isGuest = authJwt.isGuestUser(req.userId, req.userGroups);\n    if (runtime.settings?.secureEnabled && (isGuest || !authJwt.haveAdminPermission(permission))) {\n        res.status(401).json({error:\"unauthorized_error\", message: \"Unauthorized!\"});\n        runtime.logger.error(\"api post scheduler: admin permission required\");\n        return;\n    }\n    // ... rest unchanged ...\n});\n```\n\nApply the same change to the delete handler at `server/api/scheduler/index.js:102-112`. As defense in depth, the scheduler service should also validate each `deviceActions` entry against the creator's stored groups before execution (e.g., reject `onRunScript` on any scheduler whose author is not an admin at execution time).\n\n---\nA fix is available at https://github.com/frangoteam/FUXA/releases/tag/v1.3.2.\n\n---\n*Found by [aisafe.io](https://aisafe.io)*","state":0,"publishedAt":"2026-06-08T23:07:02+00:00","modifiedAt":"2026-06-08T23:26:35.850398+00:00","affected":[{"ecosystem":"npm","name":"fuxa-server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"1.1.14-1243"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/frangoteam/FUXA/security/advisories/GHSA-8ghr-w65f-j3qr","https://github.com/frangoteam/FUXA","https://github.com/frangoteam/FUXA/releases/tag/v1.3.2"],"sourceUrl":"https://github.com/advisories/GHSA-8ghr-w65f-j3qr","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-8ghr-w65f-j3qr","identifiers":["GHSA-8ghr-w65f-j3qr","CVE-2026-47721"]},"retained":false,"historicalAffected":[]}],"coverage":[]}