Web-Based Process Visualization Software Vulnerability in FUXA
CVE-2026-67440

6.9MEDIUM

Key Information:

Vendor

Frangoteam

Status
Fuxa
Vendor
CVE Published:
18 August 2026

What is CVE-2026-67440?

FUXA, a web-based Process Visualization software, presents a security vulnerability in versions 1.3.2 and earlier. The issues stem from the DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, and DEVICE_TAGS_REQUEST handlers located in server/runtime/index.js. These handlers expose critical device-discovery, node-attribute, host-network-interface, and device-tag metadata without ensuring proper authorization for socket admin privileges when secure mode is enabled. This can allow unauthenticated or guest users to exploit the system, obtaining sensitive information not typically available for public viewing. This issue has been addressed in version 1.3.3.

Affected Version(s)

FUXA < 1.3.3

References

https://github.com/frangoteam/FUXA/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/frangoteam/FUXA/pull/2379
x_refsource_MISC
https://github.com/frangoteam/FUXA/commit/4fa47d0a2a856ed...
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.