CVE-2026-67442

{
  "id": "CVE-2026-67442",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-18T21:17:18.273",
  "lastModified": "2026-10-22T20:09:59.383",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.3, DELETE /api/roles removes role definitions through server/runtime/users/usrstorage.js but does not remove the deleted role identifier from each user's info.roles array or the runtime usersMap cache. If a permission configuration still references that identifier, an affected user can retain authorization rights that an administrator intended to revoke, causing residual privilege, inconsistent access-control state, and misleading audit results. This issue is fixed in version 1.3.3."
    },
    {
      "lang": "es",
      "value": "FUXA es un software de visualización de procesos basado en web (SCADA/HMI/Dashboard). Antes de la versión 1.3.3, DELETE /API/roles elimina las definiciones de roles a través de server/runtime/users/usrstorage.js, pero no elimina el identificador de rol eliminado del array info.roles de cada usuario ni de la caché usersMap en tiempo de ejecución. Si una configuración de permisos todavía hace referencia a ese identificador, un usuario afectado puede retener derechos de autorización que un administrador pretendía revocar, lo que causa privilegios residuales, un estado de control de acceso inconsistente y resultados de auditoría engañosos. Este problema está solucionado en la versión 1.3.3."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "frangoteam",
          "product": "FUXA",
          "versions": [
            {
              "version": "< 1.3.3",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N",
          "baseScore": 2.0,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "HIGH",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 0.5,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-19T15:22:15.465945Z",
          "id": "CVE-2026-67442",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        },
        {
          "lang": "en",
          "value": "CWE-459"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/frangoteam/FUXA/commit/7ce84dc29a691b30016d65db17012bb8b282dcf0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/frangoteam/FUXA/pull/2394",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/frangoteam/FUXA/releases/tag/v1.3.3",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/frangoteam/FUXA/security/advisories/GHSA-cqww-jqx5-p32v",
      "source": "[email protected]"
    }
  ]
}