Vulnerability · Published May 26, 2026 · Assigned by GitHub_M

CVE-2026-44668Faction: Unauthenticated Read, Modify, and Delete of Boilerplate Templates

Critical 9.8

In plain English

A critical-severity missing authentication in faction from factionsecurity. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.4%top 69.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, AccessControlInterceptor, the authentication gate for all Struts2 actions, unconditionally calls invocation.invoke() without checking for a valid session. Four action methods in BoilerPlateConfig perform no local session check either, allowing an unauthenticated attacker to read, overwrite, deactivate, and permanently delete any boilerplate template in the system. This vulnerability is fixed in 1.8.3.

Affected products (as reported)

Vendor	Product	Versions
factionsecurity	faction	< 1.8.3

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/factionsecurity/faction/security/advisories/GHSA-7cv6-h22r-2qf2 x_refsource_CONFIRM
https://github.com/factionsecurity/faction/releases/tag/1.8.3 x_refsource_MISC