Vulnerability Description
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.3, DELETE /api/roles removes role definitions through server/runtime/users/usrstorage.js but does not remove the deleted role identifier from each user's info.roles array or the runtime usersMap cache. If a permission configuration still references that identifier, an affected user can retain authorization rights that an administrator intended to revoke, causing residual privilege, inconsistent access-control state, and misleading audit results. This issue is fixed in version 1.3.3.
CVSS Score
LOW
Related Weaknesses (CWE)
References
- https://github.com/frangoteam/FUXA/commit/7ce84dc29a691b30016d65db17012bb8b282dc
- https://github.com/frangoteam/FUXA/pull/2394
- https://github.com/frangoteam/FUXA/releases/tag/v1.3.3
- https://github.com/frangoteam/FUXA/security/advisories/GHSA-cqww-jqx5-p32v
FAQ
What is CVE-2026-67442?
CVE-2026-67442 is a vulnerability with a CVSS score of 2.0 (LOW). FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.3, DELETE /api/roles removes role definitions through server/runtime/users/usrstorage.js but does not remove the ...
How severe is CVE-2026-67442?
CVE-2026-67442 has been rated LOW with a CVSS base score of 2.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-67442?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.