FUXA, a web-based SCADA/HMI/Dashboard software, has a missing authorization vulnerability (CWE-862) in versions 1.3.2 and earlier. The allowDashboard authorization gate calls authJwt.verify for the /nodered endpoint but does not inspect the decoded identity. When nodeRedEnabled, secureEnabled, and nodeRedAuthMode are set to secure, a remote unauthenticated attacker can obtain a signed guest token via POST /api/heartbeat. This token grants access to the Node-RED HTTP admin editor and flow deployment API, which lacks a secondary admin authorization gate. Consequently, the attacker can deploy function nodes or invoke scripts (fuxa.runScript and runtime.scriptsMgr.runScript), gaining control over FUXA project data, configuration, scripts, filesystem-capable runtime helpers, and potentially execute OS commands if nodeRedUnsafeModules is enabled. The vulnerability is resolved in version 1.3.3.

An unauthenticated remote attacker can bypass authorization controls to gain administrative access to the Node-RED editor and deployment API within FUXA. This access allows modification and deployment of scripts and function nodes, leading to full control over project data, configuration, and runtime script execution. If unsafe modules are enabled, the attacker may execute arbitrary operating system commands, severely compromising the affected system.

Upgrade FUXA to version 1.3.3 or later, where this missing authorization vulnerability is fixed. No other mitigations are specified by the vendor advisory.