CVE-2026-67442

LowCVSS 2.0/10Last modified Oct 22, 2026

Description

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.3, DELETE /api/roles removes role definitions through server/runtime/users/usrstorage.js but does not remove the deleted role identifier from each user's info.roles array or the runtime usersMap cache. If a permission configuration still references that identifier, an affected user can retain authorization rights that an administrator intended to revoke, causing residual privilege, inconsistent access-control state, and misleading audit results. This issue is fixed in version 1.3.3.

Metrics

CVSS 3.1 2.0/10CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-284CWE-459

Affected software

No affected versions have been published.

Timeline

Published
Aug 18, 2026
Last modified
Oct 22, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-674439.2FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the allowDashboard authorization gate in serCVE-2026-674455.3Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit reads SMTP commands through internal/smtpd/smtpd.go sessioCVE-2026-674465.3Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raCVE-2026-674475.3Mailpit is an email testing tool and API for developers. From 1.30.0 until 1.30.5, Mailpit's internal/smtpd/smtpd.go readData() function calCVE-2026-674486.5Mailpit is an email testing tool and API for developers. From 1.29.0 until 1.30.6, Mailpit's server/server.go origin middleware checks the rCVE-2026-67453.5A vulnerability was determined in Bagisto up to 2.3.15. Affected by this vulnerability is an unknown functionality of the component Custom SCVE-2026-674564.4NVIDIA Warp contains a vulnerability where an attacker could cause a heap-based buffer overflow. A successful exploit of this vulnerability CVE-2026-67467.5Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, ThundCVE-2026-674657.5A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. ThisCVE-2026-67477.5Use-after-free in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 14CVE-2026-67489.8Uninitialized memory in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird CVE-2026-67497.5Information disclosure due to uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 150, Firefox