CVE-2026-67442: CWE-284: Improper Access Control in frangoteam FUXA
CVE-2026-67442 is an improper access control vulnerability in frangoteam's FUXA web-based Process Visualization software. Versions prior to 1.3.3 have an issue where deleting a role does not fully remove the role identifier from users' role arrays or runtime caches. This can cause users to retain permissions that administrators intended to revoke, leading to residual privileges and inconsistent access control states. The issue is fixed in version 1.3.3.
AI Analysis
Technical Summary
FUXA versions before 1.3.3 contain a flaw in the DELETE /api/roles endpoint where role deletions do not fully propagate to user role assignments and runtime caches. Specifically, the deleted role identifier remains in users' info.roles arrays and the runtime usersMap cache if permission configurations still reference it. This results in affected users retaining authorization rights that should have been revoked, causing residual privilege and misleading audit results. The vulnerability is classified as CWE-284 (Improper Access Control) and CWE-459 (Incomplete Cleanup).
Potential Impact
Users may retain authorization rights that administrators intended to revoke, causing residual privileges and inconsistent access control states. This can lead to misleading audit results. The CVSS score is low (2.0), reflecting limited impact with high attack complexity and required privileges.
Mitigation Recommendations
Upgrade to FUXA version 1.3.3 or later, where this issue is fixed. No other mitigation is required as the vendor has provided an official fix.
CVE-2026-67442: CWE-284: Improper Access Control in frangoteam FUXA
Description
CVE-2026-67442 is an improper access control vulnerability in frangoteam's FUXA web-based Process Visualization software. Versions prior to 1.3.3 have an issue where deleting a role does not fully remove the role identifier from users' role arrays or runtime caches. This can cause users to retain permissions that administrators intended to revoke, leading to residual privileges and inconsistent access control states. The issue is fixed in version 1.3.3.
CVSS v3.1
Score 2.0low
Affected software
frangoteam
FUXA
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
FUXA versions before 1.3.3 contain a flaw in the DELETE /api/roles endpoint where role deletions do not fully propagate to user role assignments and runtime caches. Specifically, the deleted role identifier remains in users' info.roles arrays and the runtime usersMap cache if permission configurations still reference it. This results in affected users retaining authorization rights that should have been revoked, causing residual privilege and misleading audit results. The vulnerability is classified as CWE-284 (Improper Access Control) and CWE-459 (Incomplete Cleanup).
Potential Impact
Users may retain authorization rights that administrators intended to revoke, causing residual privileges and inconsistent access control states. This can lead to misleading audit results. The CVSS score is low (2.0), reflecting limited impact with high attack complexity and required privileges.
Mitigation Recommendations
Upgrade to FUXA version 1.3.3 or later, where this issue is fixed. No other mitigation is required as the vendor has provided an official fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-29T15:07:24.992Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a84be80c6e8be0332b43d19
Added to database: 08/18/2026, 20:20:16 UTC
Last enriched: 09/11/2026, 21:02:47 UTC
Last updated: 10/02/2026, 14:46:09 UTC
Views: 88
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.