CVE-2026-47721: 
JavaScript vulnerability analysis and mitigation

CVE-2026-47721 is a missing authorization vulnerability in the FUXA SCADA/HMI platform's Scheduler API that allows authenticated non-admin (operator-level) users to create or modify scheduled actions restricted to administrators. It affects the fuxa-server npm package versions up to and including 1.3.1 (npm package <= 1.1.14-1243). The vulnerability was discovered by aisafe.io, published to the GitHub Advisory Database on June 8, 2026, and assigned GHSA-8ghr-w65f-j3qr. It carries a CVSS v3.1 base score of 6.3 (Medium) (GitHub Advisory, FUXA Advisory).

The root cause is CWE-862 (Missing Authorization): the POST /api/scheduler and DELETE /api/scheduler API endpoints in FUXA's server did not invoke authJwt.haveAdminPermission(permission) before processing requests, unlike other write endpoints that reach runtime.devices.setTagValue or runtime.scriptsMgr.runScript. Any authenticated user with a valid JWT — including operator-level accounts — could send HTTP POST requests to /api/scheduler to create or modify scheduled jobs. The attack requires only low-privilege network access with no user interaction, and the scheduled nature of the actions means the malicious configuration persists and re-executes on a schedule even after manual admin remediation (FUXA Advisory, GitHub Advisory).

In a SCADA/ICS deployment, successful exploitation allows an operator-level user to perform PLC tag writes (e.g., rewriting a pump's enable tag or opening a safety interlock) and execute server-side automation scripts — capabilities normally restricted to administrators. The persistent, repeating schedule model means that even if an administrator manually reverts a malicious change, the scheduled action will re-apply it on the next cycle without requiring the attacker to maintain an active session. This creates a risk of physical process disruption, safety system bypass, and unauthorized automation logic execution in industrial environments (FUXA Advisory, GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported for CVE-2026-47721. The EPSS score is approximately 0.043% (15th percentile), indicating a low near-term exploitation probability. The CVE status remains "Reserved" and it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was discovered and reported by aisafe.io (GitHub Advisory, FUXA Advisory).

1. Obtain operator credentials: Acquire a valid non-admin (operator-level) account on the target FUXA instance, either through legitimate access, credential theft, or brute force.
2. Authenticate and obtain JWT: Log in to the FUXA web interface or API to obtain a valid JSON Web Token for the operator account.
3. Craft a malicious scheduler payload: Construct a JSON payload targeting the POST /api/scheduler endpoint that defines a scheduled action — such as a device tag write (setTagValue) to alter a PLC setpoint or a script execution (onRunScript) to run a privileged automation script.
4. Submit the request: Send the crafted HTTP POST request to /api/scheduler with the operator JWT in the Authorization header. Because the endpoint lacks admin permission checks, the server accepts and stores the scheduled action.
5. Persistent execution: The FUXA scheduler service executes the malicious action on the configured schedule (e.g., every minute), persistently applying unauthorized device changes or script executions even if an administrator manually reverts them (FUXA Advisory, GitHub Advisory).

• Network: Unexpected HTTP POST or DELETE requests to /api/scheduler originating from accounts with non-admin roles; API calls to scheduler endpoints outside of normal administrative workflows.
• Logs: FUXA server logs showing scheduler creation or modification events attributed to operator-level user IDs; absence of expected "api post scheduler: admin permission required" log entries on unpatched systems where such requests succeed.
• Application State: Presence of unexpected or unauthorized scheduled actions in the FUXA scheduler configuration, particularly those involving device tag writes or script execution; scheduled jobs with repeating intervals that were not created by administrators.
• Process/Runtime: Unexpected execution of automation scripts (onRunScript) or device value changes (setTagValue) at regular intervals not matching legitimate operational schedules (FUXA Advisory).

Upgrade FUXA to version 1.3.2 or later, which enforces authJwt.haveAdminPermission(permission) on both POST /api/scheduler and DELETE /api/scheduler endpoints. As a defense-in-depth measure, the advisory also recommends validating each deviceActions entry against the creator's stored groups at execution time, rejecting onRunScript actions from non-admin authors. Until patching is possible, restrict network access to the FUXA API to trusted administrative users only and audit existing scheduler configurations for unauthorized entries (FUXA Release v1.3.2, FUXA Advisory).