by Kastro
Paper/Archive/CVE-2026-44668

CVE-2026-44668

factionsecurity faction — Faction: Unauthenticated Read, Modify, and Delete of Boilerplate Templates

EPSS 0.4%public exploitCVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 30.3.303 × 206.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, AccessControlInterceptor, the authentication gate for all Struts2 actions, unconditionally calls invocation.invoke() without checking for a valid session. Four action methods in BoilerPlateConfig perform no local session check either, allowing an unauthenticated attacker to read, overwrite, deactivate, and permanently delete any boilerplate template in the system. This vulnerability is fixed in 1.8.3.

Affected

ProductAffectedFixed inSource
faction< 1.8.3–CNA

Scores by source

GitHub_M (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/factionsecurity/faction/security/advisories/GHSA-7cv6-h22r-2qf2refgithub.com/factionsecurity/faction/releases/tag/1.8.3