PT-2026-43346 · Factionsecurity · Faction

Bettridgekameron · Published 2026-05-26 · Updated 2026-05-27 · CVE-2026-44668

NVD

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, AccessControlInterceptor, the authentication gate for all Struts2 actions, unconditionally calls invocation.invoke() without checking for a valid session. Four action methods in BoilerPlateConfig perform no local session check either, allowing an unauthenticated attacker to read, overwrite, deactivate, and permanently delete any boilerplate template in the system. This vulnerability is fixed in 1.8.3.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-44668

Affected Products

Faction

References · 4

• 🔥 https://github.com/factionsecurity/faction/security/advisories/GHSA-7cv6-h22r-2qf2 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44668 · Security Note
• https://github.com/factionsecurity/faction/releases/tag/1.8.3 · Note
• https://twitter.com/PurpleOps_io/status/2059492727264338071 · Twitter Post