CVE-2026-44668

Published: May 26, 2026Modified: Jul 20, 2026Deferred

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: security-advisories@github.com (Secondary)

Description

FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, AccessControlInterceptor, the authentication gate for all Struts2 actions, unconditionally calls invocation.invoke() without checking for a valid session. Four action methods in BoilerPlateConfig perform no local session check either, allowing an unauthenticated attacker to read, overwrite, deactivate, and permanently delete any boilerplate template in the system. This vulnerability is fixed in 1.8.3.

Related CWEs

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (3)

https://github.com/factionsecurity/faction/releases/tag/1.8.3

Source: security-advisories@github.com

https://github.com/factionsecurity/faction/security/advisories/GHSA-7cv6-h22r-2qf2

Source: security-advisories@github.com

https://github.com/factionsecurity/faction/security/advisories/GHSA-7cv6-h22r-2qf2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.