Authorization Bypass in FUXA by Talos Intelligence
CVE-2026-42949

5.6MEDIUM

Key Information:

Vendor

Frangoteam

Status
Frangoteam
Vendor
CVE Published:
29 October 2026

What is CVE-2026-42949?

An authorization bypass vulnerability is present in the /api/runscript functionality of FUXA, specifically in version 1.3.2-2809. This flaw allows an attacker to execute privileged operations by sending specially crafted unauthenticated HTTP requests. If exploited, this vulnerability can lead to unauthorized access and potentially compromise the integrity of the affected system.

Affected Version(s)

Frangoteam 1.3.2-2809

References

https://talosintelligence.com/vulnerability_reports/TALOS...

CVSS V3.1

Score:
5.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Discovered by Matt Wiseman of Cisco Talos
.