IA Squad
PT
js · fuxa-serverHeads-up

fuxa-server: Scheduler API missing admin permission checks fixed in 1.3.2

The Scheduler API did not enforce administrator permissions, allowing non-admin users to create or modify scheduled actions that execute privileged operations like device value changes and server-side script execution.

09 Jun 2026Read 1 minSeverity: schedule it

What changed

The Scheduler API did not enforce administrator permissions, allowing non-admin users to create or modify scheduled actions that execute privileged operations like device value changes and server-side script execution. The fix in version 1.3.2 adds permission checks to POST and DELETE /api/scheduler endpoints.

Who it affects

All FUXA deployments using the Scheduler API, especially those with operator-level users who should not have admin privileges.

What to do today

Upgrade to FUXA version 1.3.2 or later to apply the permission enforcement fix.

The trail
Collected Audited Written Published