CVE-2026-67442

🗓️ 18 Aug 2026 20:08:23Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 39 Views🌐 WEB

FUXA before 1.3.3 retains deleted role IDs in users' info.roles, causing residual privilege escalation.

Reporter	Title	Published	Views	Family All 7
Cvelist	CVE-2026-67442 FUXA Business Logic Flaw: Role Deletion Without User Assignment Cleanup	18 Aug 202620:08	–	cvelist
EUVD	EUVD-2026-61214	18 Aug 202620:08	–	euvd
Mend	CVE-2026-67442	18 Aug 202620:08	–	mend
NVD	CVE-2026-67442	18 Aug 202621:17	–	nvd
osv_cve	CVE-2026-67442 FUXA Business Logic Flaw: Role Deletion Without User Assignment Cleanup	18 Aug 202620:08	–	osv_cve
Positive Technologies	PT-2026-77307	18 Aug 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-67442: Improper Access Control	18 Aug 202600:00	–	rapid7

Vulners

Node

frangoteam fuxaRange<1.3.3

[
  {
    "vendor": "frangoteam",
    "product": "FUXA",
    "versions": [
      {
        "version": "< 1.3.3",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/frangoteam/FUXA/security/advisories/GHSA-cqww-jqx5-p32v
github	www.github.com/frangoteam/FUXA/releases/tag/v1.3.3
github	www.github.com/frangoteam/FUXA/commit/7ce84dc29a691b30016d65db17012bb8b282dcf0
github	www.github.com/frangoteam/FUXA/pull/2394

Parameter	Position	Path	Description	CWE
DELETE	path	/api/roles	The DELETE /api/roles endpoint fails to remove deleted role identifiers from the usersMap cache and individual user info.roles arrays, leading to residual privileges for users whose roles were intended to be revoked.	CWE-284, CWE-459

22 Oct 2026 20:09Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.12

EPSS0.00324