CVE-2026-44668
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
In FACTION prior to 1.8.3, AccessControlInterceptor unconditionally calls invocation.invoke() without checking for a valid session. Four action methods in BoilerPlateConfig perform no local session check either, allowing an unauthenticated attacker to read, overwrite, deactivate, and permanently delete any boilerplate template in the system.
Risk Assessment
The organization is at risk of unauthorized access to sensitive report templates, their modification or deletion, potentially leading to data loss and compromised integrity of penetration testing processes.
Recommendation
Immediately upgrade FACTION to version 1.8.3 or later, which contains the fix for this vulnerability.
Original NVD description (English source)
FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, AccessControlInterceptor, the authentication gate for all Struts2 actions, unconditionally calls invocation.invoke() without checking for a valid session. Four action methods in BoilerPlateConfig perform no local session check either, allowing an unauthenticated attacker to read, overwrite, deactivate, and permanently delete any boilerplate template in the system. This vulnerability is fixed in 1.8.3.