The vulnerability in FUXA arises when the DELETE /api/roles endpoint removes a role definition but fails to eliminate the role identifier from each user's info.roles array or the runtime usersMap cache. Because permissions can still reference that deleted role ID, affected users retain authorization that administrators intended to revoke, leading to residual privilege escalation, inconsistent access‑control state, and misleading audit results.

The flaw affects Frangoteam's FUXA product. Any deployment of FUXA prior to version 1.3.3 is vulnerable. The issue is resolved in FUXA 1.3.3 and later.

The CVSS score of 2 indicates low severity, but the flaw can allow privilege escalation for users with the ability to delete roles, which requires authenticated access to the API. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation. Attackers would need authorized privileges, so the risk is limited to privileged users but could undermine audit integrity and access control.