CVE-2026-67442

Received Received - Intake

Privilege Escalation in FUXA SCADA Software

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.3, DELETE /api/roles removes role definitions through server/runtime/users/usrstorage.js but does not remove the deleted role identifier from each user's info.roles array or the runtime usersMap cache. If a permission configuration still references that identifier, an affected user can retain authorization rights that an administrator intended to revoke, causing residual privilege, inconsistent access-control state, and misleading audit results. This issue is fixed in version 1.3.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-67442

EUVD

EUVD-2026-61214

Affected Vendors & Products

Vendor	Product	Version / Range
fuxa	process_visualization	to 1.3.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-459	The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability in FUXA software (versions before 1.3.3) allows deletion of role definitions without properly updating user permissions. When a role is deleted via the DELETE /api/roles endpoint, the system fails to remove the deleted role from user accounts or the runtime cache. This leaves users with unauthorized access rights that were meant to be revoked, creating inconsistent access control and misleading audit trails.

Detection Guidance

To detect this vulnerability, check if your FUXA version is below 1.3.3. Review user role assignments and audit logs for inconsistencies in permissions after role deletions. Inspect runtime/usersMap cache and users/usrstorage.js for orphaned role identifiers.

Impact Analysis

If you use FUXA versions before 1.3.3, unauthorized users may retain elevated permissions after an administrator attempts to revoke them. This could allow those users to perform actions they shouldn't, leading to potential data breaches, system misuse, or compliance violations. The issue creates a security gap where access control policies become unreliable.

Compliance Impact

This vulnerability could lead to non-compliance with regulations requiring strict access controls and auditability (e.g., GDPR's data protection principles or HIPAA's access management rules). Unauthorized privilege retention undermines proper authorization management, making it difficult to demonstrate compliance with mandatory access control and audit logging requirements.

Mitigation Strategies

Upgrade FUXA to version 1.3.3 or later immediately. Manually verify and remove any deleted role identifiers from user info.roles arrays and runtime usersMap cache. Audit all permissions to ensure no residual access remains.

Hi! I’m here to help you understand CVE-2026-67442. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70