CyberRota Analysis
AI-GeneratedThe vulnerability affects FUXA web-based Process Visualization software, where the DELETE API for role management fails to fully remove role identifiers from user data after deletion. This oversight can lead to residual privileges, allowing users to retain access rights that should have been revoked, resulting in inconsistent access control and misleading audit trails. Organizations using versions prior to 1.3.3 should prioritize updating to mitigate potential security risks associated with unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.3, DELETE /api/roles removes role definitions through server/runtime/users/usrstorage.js but does not remove the deleted role identifier from each user's info.roles array or the runtime usersMap cache. If a permission configuration still references that identifier, an affected user can retain authorization rights that an administrator intended to revoke, causing residual privilege, inconsistent access-control state, and misleading audit results. This issue is fixed in version 1.3.3.