js · fuxa-serverHeads-up
fuxa-server: Scheduler API missing admin permission checks fixed in 1.3.2
The Scheduler API did not enforce administrator permissions, allowing non-admin users to create or modify scheduled actions that execute privileged operations like device value changes and server-side script execution.
What changed
The Scheduler API did not enforce administrator permissions, allowing non-admin users to create or modify scheduled actions that execute privileged operations like device value changes and server-side script execution. The fix in version 1.3.2 adds permission checks to POST and DELETE /api/scheduler endpoints.
Who it affects
All FUXA deployments using the Scheduler API, especially those with operator-level users who should not have admin privileges.
What to do today
Upgrade to FUXA version 1.3.2 or later to apply the permission enforcement fix.
The trail
Collected→
Audited→
Written→
Published