CVE Intelligence
Analysis AI-assisted

CVE-2026-44668: FACTION PenTesting Framework: Missing Authentication on Struts2 Actions

FACTION versions prior to 1.8.3 allow unauthenticated requests to reach Struts2 actions and BoilerPlateConfig methods that should require a valid session. An attacker could read, overwrite, deactivate and permanently delete boilerplate templates. GitHub reports a CVSS 3.1 score of 9.8, and the record does not list the CVE in CISA KEV or any confirmed exploitation.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

FACTION is a penetration testing report generation and collaboration framework. The GitHub advisory and the description in the record state that versions prior to 1.8.3 contain a missing authentication flaw (CWE-306) that affects the access control layer protecting Struts2 actions.

Impact

  • The authentication gate AccessControlInterceptor calls the requested action without checking for a valid session.
  • Four action methods in BoilerPlateConfig also perform no local session check.
  • An unauthenticated remote attacker could read, overwrite, deactivate and permanently delete any boilerplate template in the system.
  • The CVSS 3.1 base score of 9.8 (critical), supplied by the GitHub CNA, reflects a network-reachable flaw requiring no privileges or user interaction, with high confidentiality, integrity and availability impact.

Affected products and versions

  • Product: FACTION, by factionsecurity.
  • Affected range: versions prior to 1.8.3, as stated in the description.
  • Fixed version: 1.8.3, as stated in the description and referenced by the project release tag.
  • The structured affected and fixes fields in the record are empty, so the version range relies on the narrative description.

Exploitation status

  • The record shows that this CVE is not listed in the CISA KEV catalog.
  • No confirmed exploitation appears in the sources consulted.
  • The EPSS probability is about 0.66 percent, with a percentile of about 50 percent, as recorded in the data provided.

Remediation and mitigation

  • Upgrade FACTION to version 1.8.3, the version stated as fixing the issue.
  • Until the upgrade is applied, limit network exposure of FACTION instances to trusted networks (this is a general recommendation, not stated by the source).
  • Confirm that boilerplate templates are backed up so that any deletion or overwrite can be recovered.

Detection guidance

  • Review web application logs for requests to boilerplate template management functions that lack an authenticated session.
  • Monitor for unexpected changes, deactivations or deletions of boilerplate templates.
  • After any suspicious activity, compare the template inventory with a known good backup.

Limitations of the available information

  • The record does not provide affected or fixed versions in structured fields; the version range comes from the description.
  • The record shows a source status of Deferred, and the CVSS figure is supplied by the GitHub CNA.
  • The sources consulted do not provide exploitation timelines, and this analysis does not include technical exploitation details.

Frequently asked questions

What is affected by CVE-2026-44668?

According to the record, FACTION versions prior to 1.8.3 are affected because the authentication gate for Struts2 actions and four BoilerPlateConfig methods do not verify a valid session.

Which version fixes this issue?

The description and the referenced release tag indicate that version 1.8.3 fixes the vulnerability.

Is this vulnerability known to be exploited?

The record does not list this CVE in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.