FUXA uses JSON Web Tokens for authentication, and the implementation in version 1.3.2 and earlier contains a flaw in the refresh and heartbeat endpoints. When a refresh request is made, the server falls back from the current user data to the decoded JWT groups, even if the account has been deleted or the user’s group list is empty. When a heartbeat request is received, the server re‑signs the inbound JWT claims without checking the current state of the corresponding user in the database. As a result, an attacker who holds a valid privileged refresh cookie or access token can continue to mint new privileged JWTs after the account has been deleted, disabled, or its role reduced. This grants continued and arbitrary access to user‑management, project modification, runtime configuration, scripting, and the creation of hidden backdoor accounts, with a CVSS score of 7.5.

The affected product is frangoteam’s FUXA Process Visualization platform. All releases equal to or older than 1.3.2 are impacted; the vulnerability was fixed in release 1.3.3.

The CVSS base score of 7.5 signals a high impact and the exploit requires possession of a previously issued token, which an attacker can obtain through logging or phishing of a privileged session. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Because the flaw relies on server‑side validation logic, the attack can be performed remotely via the web interface without requiring local system access. The risk of continued privileged access is significant for any organization that permits long‑lived session tokens or fails to revoke tokens upon account changes.