CVE-2026-42949medium5.6

A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809).

Impact

A authorization bypass vulnerability exists in FUXA version 1.3.2-2809, allowing an attacker to make an unauthenticated HTTP request to execute privileged operations via the /api/runscript functionality. The vulnerability is due to improper authorization. An attacker needs to send a specially crafted HTTP request to trigger this vulnerability.

Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.

Affected packages

This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.

Affected products

Vendor version evidence. Product records are separate from automatic dependency matching.

frangoteam · talos

Frangoteam

1 range

talos version evidence

Check a product version

Compare with this publisher’s ranges. This does not inspect your installation.

affected

1.3.2-2809

Other versions: unaffected

Original source description

A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to execute priviledged operation. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.

Inside the record

Evidence available

Package identity · not supplied

Version evidence

Remediation guidance · not supplied

Weakness classification

Additional publishers

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-42949

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Underlying weaknesses

The source’s classification of what caused the vulnerability.

CWE-285 ↗

CWE-285: Improper Authorization

talos

Contributing organizations · 2

talos

Assigning organization

2026-10-29

CISA-ADP

Additional data publisher

2026-10-29

What changed

Follow changes

No substantive changes have been recorded here yet. History starts when cve.new observes a change after tracking is enabled; earlier edits are not reconstructed.

Large field values are marked as truncated previews. Original source snapshots remain retained.

References

1 sources

talosintelligence.com/vulnerability_reports/TALOS-2026-2417

Security advisorytalos

Priority and evidence

Not in CISA KEVNo package fix recorded

KEV coverage does not rule out exploitation.

KEV checked 31/10/2026, 07:45:30 UTC

talos · CVSS:3.1 · 5.6

Assessment vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Reading the signals

Severity · CVSS: Technical impact and attack conditions. The headline is the highest imported catalog score; sources may disagree.
Observed exploitation · KEV: An absent or unavailable KEV listing does not establish that exploitation has not occurred.
Predicted exploitation · EPSS: No EPSS estimate available in this record.

CISA-ADP · SSVC

CISA Coordinator · 2026-10-29

Exploitation: none
Automatable: no
Technical Impact: total

SSVC describes the publisher’s decision context. Your organization’s exposure and priorities may differ.

Record details

Published: 29/10/2026, 02:59:52 UTC
Modified: 29/10/2026, 12:32:40 UTC
Last imported by cve.new: 29/10/2026, 14:38:10 UTC
Aliases: None recorded

Source evidence

Request a correction or dispute

Start with the assigning organization for this record. Include the CVE ID, the disputed information, and supporting evidence. A dispute does not itself reject a record.

Find the responsible CNA →Official dispute and escalation process ↗

CVE CVE-2026-42949