CVE-2026-65984

CVE-2026-65984 carries a CVSS 7.5 base score, but that number fundamentally misrepresents the risk if you're running FUXA in a SCADA/OT environment. The vulnerability lets attackers retain access after account deletion or demotion because the system validates JWT claims rather than querying current authorization state during token refresh and heartbeat operations. In a general web app, that's unauthorized data access. In an industrial HMI that controls PLCs, modifies safety interlock scripts, or adjusts operational parameters, it's a pathway to physical consequences the CVSS framework cannot model. The 1.3.3 patch adds database state validation to `/api/refresh` and `/api/heartbeat`, which is the correct fix for the code bug. But it's the wrong fix for SCADA availability requirements. Every authenticated request now triggers a database round-trip, and in continuous monitoring workloads with high polling density, that compounds into latency and creates a cascading failure mode: if the database becomes unreachable during normal operations—whether from network partition, maintenance, or replication lag—every active session across every operator terminal drops simultaneously. In environments where availability is a safety requirement, the countermeasure introduces the exact harm it was meant to prevent. There's also a deployment footprint problem that EPSS (0.00467) won't catch. FUXA often ends up on workstations in IT corridors, installed for temporary commissioning and never decommissioned. These forgotten nodes sit on converged IT/OT networks reachable via supply chain compromises. The air-gapped population that keeps EPSS low isn't protective—it's just harder to discover. If you've deployed FUXA in any safety-critical context, treat this as high severity regardless of the CVSS number. Patch to 1.3.3, but monitor your database query latency under realistic SCADA load. If operators report spurious session drops or responsiveness issues, the pressure to disable the validation will be immense—and that's when the next vulnerability in this lineage will emerge.

Reviewed through automated stages and approved by a human before publication.