CVE-2026-44668

9.8 Critique

Publiée le 26/05/2026 à 20:16 · Modifiée le 20/07/2026 à 22:10 · Analyse NVD reportée · Source : security-advisories@github.com

Description

FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, AccessControlInterceptor, the authentication gate for all Struts2 actions, unconditionally calls invocation.invoke() without checking for a valid session. Four action methods in BoilerPlateConfig perform no local session check either, allowing an unauthenticated attacker to read, overwrite, deactivate, and permanently delete any boilerplate template in the system. This vulnerability is fixed in 1.8.3.

Traduire en français

Produits concernés

factionsecurity faction

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.8 Critique	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-306

Références

https://github.com/factionsecurity/faction/releases/tag/1.8.3
https://github.com/factionsecurity/faction/security/advisories/GHSA-7cv6-h22r-2qf2
https://github.com/factionsecurity/faction/security/advisories/GHSA-7cv6-h22r-2qf2

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories