CVE-2026-67442
LowCVSS 2.0Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.3, DELETE /api/roles removes role definitions but does not remove the deleted role identifier from user's info.roles array or runtime usersMap cache. This can lead to retained authorization rights after admin revocation.
Risk Assessment
Risk of uncontrolled access to SCADA system, potentially leading to unauthorized actions and misleading audit results.
Recommendation
Update FUXA to version 1.3.3 or later, which includes the fix.
Original NVD description (English source)
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.3, DELETE /api/roles removes role definitions through server/runtime/users/usrstorage.js but does not remove the deleted role identifier from each user's info.roles array or the runtime usersMap cache. If a permission configuration still references that identifier, an affected user can retain authorization rights that an administrator intended to revoke, causing residual privilege, inconsistent access-control state, and misleading audit results. This issue is fixed in version 1.3.3.