PT-2026-43346 · Factionsecurity · Faction

Bettridgekameron · Publicado 2026-05-26 · Atualizado 2026-05-27 · CVE-2026-44668

NVD

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, AccessControlInterceptor, the authentication gate for all Struts2 actions, unconditionally calls invocation.invoke() without checking for a valid session. Four action methods in BoilerPlateConfig perform no local session check either, allowing an unauthenticated attacker to read, overwrite, deactivate, and permanently delete any boilerplate template in the system. This vulnerability is fixed in 1.8.3.

Exploit

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2026-44668

Produtos afetados

Faction

Referências · 4

• 🔥 https://github.com/factionsecurity/faction/security/advisories/GHSA-7cv6-h22r-2qf2 · Exploit
• https://github.com/factionsecurity/faction/releases/tag/1.8.3 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-44668 · Nota de Segurança
• https://twitter.com/PurpleOps_io/status/2059492727264338071 · Publicação no Twitter