What’s Vulnerable › Vulnerabilities

CVE-2026-44668: Faction: Unauthenticated Read, Modify, and Delete of Boilerplate Templates

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-26 · updated 2026-07-20
• Weakness: CWE-306

Description

FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, AccessControlInterceptor, the authentication gate for all Struts2 actions, unconditionally calls invocation.invoke() without checking for a valid session. Four action methods in BoilerPlateConfig perform no local session check either, allowing an unauthenticated attacker to read, overwrite, deactivate, and permanently delete any boilerplate template in the system. This vulnerability is fixed in 1.8.3.

Affected products

• factionsecurity faction: before 1.8.3

References

• https://github.com/factionsecurity/faction/releases/tag/1.8.3
• https://github.com/factionsecurity/faction/security/advisories/GHSA-7cv6-h22r-2qf2
• https://github.com/factionsecurity/faction/security/advisories/GHSA-7cv6-h22r-2qf2

Get alerted when CVE-2026-44668 or the next vulnerability affects your stack