The vulnerability stems from missing enforcement of admin permissions on the Scheduler API endpoints for creating and deleting scheduled actions. An authenticated user with operator privileges can add or modify schedules that trigger device actions such as setting PLC values or executing server‑side scripts. This allows the operator to perform operations that are normally restricted to administrators, potentially altering critical device setpoints, safety interlocks, or project data after the session ends, thereby compromising system integrity and safety.

The issue affects the FUXA web‑based Process Visualization platform by frangoteam. All versions prior to 1.3.2 are vulnerable to the missing admin check on POST /api/scheduler and DELETE /api/scheduler. The fix is incorporated beginning with release 1.3.2.

The vulnerability carries a CVSS score of 6.3 and is not listed in the CISA KEV catalog, with no EPSS data available. Attack requires an authenticated non‑admin operator account, so the attack vector is internal and based on legitimate access. The mitigated risk depends on an attacker’s ability to create or modify schedules that can affect device state, thereby enabling privilege escalation and potential safety violations.