CVE-2026-67442

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.3, DELETE /api/roles removes role definitions through server/runtime/users/usrstorage.js but does not remove the deleted role identifier from each user's info.roles array or the runtime usersMap cache. If a permission configuration still references that identifier, an affected user can retain authorization rights that an administrator intended to revoke, causing residual privilege, inconsistent access-control state, and misleading audit results. This issue is fixed in version 1.3.3.

CVSS v3 2.0 LOW

2.0^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.5 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/frangoteam/FUXA/commit/7ce84dc29a691b30016d65db17012bb8b282dcf0
https://github.com/frangoteam/FUXA/pull/2394
https://github.com/frangoteam/FUXA/releases/tag/v1.3.3
https://github.com/frangoteam/FUXA/security/advisories/GHSA-cqww-jqx5-p32v

Configurations

No configuration.

History

22 Oct 2026, 20:09

Type	Values Removed	Values Added
Summary		(es) FUXA es un software de visualización de procesos basado en web (SCADA/HMI/Dashboard). Antes de la versión 1.3.3, DELETE /API/roles elimina las definiciones de roles a través de server/runtime/users/usrstorage.js, pero no elimina el identificador de rol eliminado del array info.roles de cada usuario ni de la caché usersMap en tiempo de ejecución. Si una configuración de permisos todavía hace referencia a ese identificador, un usuario afectado puede retener derechos de autorización que un administrador pretendía revocar, lo que causa privilegios residuales, un estado de control de acceso inconsistente y resultados de auditoría engañosos. Este problema está solucionado en la versión 1.3.3.

Information

Published : 2026-08-18 21:17

Updated : 2026-10-22 20:09

NVD link : CVE-2026-67442

Mitre link : CVE-2026-67442

CVE.ORG link : CVE-2026-67442

JSON object : View

Products Affected

No product.

CWE

CWE-284

Improper Access Control

CWE-459

Incomplete Cleanup

{"id": "CVE-2026-67442", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67442", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-19T15:22:15.465945Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.0, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 0.5}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "frangoteam", "product": "FUXA", "versions": [{"status": "affected", "version": "< 1.3.3"}]}]}], "published": "2026-08-18T21:17:18.273", "references": [{"url": "https://github.com/frangoteam/FUXA/commit/7ce84dc29a691b30016d65db17012bb8b282dcf0", "source": "security-advisories@github.com"}, {"url": "https://github.com/frangoteam/FUXA/pull/2394", "source": "security-advisories@github.com"}, {"url": "https://github.com/frangoteam/FUXA/releases/tag/v1.3.3", "source": "security-advisories@github.com"}, {"url": "https://github.com/frangoteam/FUXA/security/advisories/GHSA-cqww-jqx5-p32v", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-459"}]}], "descriptions": [{"lang": "en", "value": "FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.3, DELETE /api/roles removes role definitions through server/runtime/users/usrstorage.js but does not remove the deleted role identifier from each user's info.roles array or the runtime usersMap cache. If a permission configuration still references that identifier, an affected user can retain authorization rights that an administrator intended to revoke, causing residual privilege, inconsistent access-control state, and misleading audit results. This issue is fixed in version 1.3.3."}, {"lang": "es", "value": "FUXA es un software de visualizaci\u00f3n de procesos basado en web (SCADA/HMI/Dashboard). Antes de la versi\u00f3n 1.3.3, DELETE /API/roles elimina las definiciones de roles a trav\u00e9s de server/runtime/users/usrstorage.js, pero no elimina el identificador de rol eliminado del array info.roles de cada usuario ni de la cach\u00e9 usersMap en tiempo de ejecuci\u00f3n. Si una configuraci\u00f3n de permisos todav\u00eda hace referencia a ese identificador, un usuario afectado puede retener derechos de autorizaci\u00f3n que un administrador pretend\u00eda revocar, lo que causa privilegios residuales, un estado de control de acceso inconsistente y resultados de auditor\u00eda enga\u00f1osos. Este problema est\u00e1 solucionado en la versi\u00f3n 1.3.3."}], "lastModified": "2026-10-22T20:09:59.383", "sourceIdentifier": "security-advisories@github.com"}