CVE-2026-44668

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-44668

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44668.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-44668

Aliases

GHSA-7cv6-h22r-2qf2

Published

2026-05-26T17:43:49.177Z

Modified

2026-07-08T08:05:15.913711132Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Faction: Unauthenticated Read, Modify, and Delete of Boilerplate Templates

Details

FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, AccessControlInterceptor, the authentication gate for all Struts2 actions, unconditionally calls invocation.invoke() without checking for a valid session. Four action methods in BoilerPlateConfig perform no local session check either, allowing an unauthenticated attacker to read, overwrite, deactivate, and permanently delete any boilerplate template in the system. This vulnerability is fixed in 1.8.3.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44668.json",
    "cwe_ids": [
        "CWE-306"
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/factionsecurity/faction

Affected ranges

Type

GIT

Repo

https://github.com/factionsecurity/faction

Events

Introduced

Fixed

90b341744fb65c4fb916c997533695c6da75e41f

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.8.3"
        }
    ]
}

Affected versions

1.*

1.1.0

1.1.1

1.1.10

1.1.11

1.1.12

1.1.13

1.1.14

1.1.15

1.1.16

1.1.17

1.1.18

1.1.19

1.1.2

1.1.20

1.1.21

1.1.22

1.1.23

1.1.24

1.1.24.0

1.1.24.1

1.1.24.2

1.1.24.3

1.1.25

1.1.25.0

1.1.25.1

1.1.26.0

1.1.26.1

1.1.26.2

1.1.27

1.1.3

1.1.4

1.1.5

1.1.6

1.1.7

1.1.8

1.1.9

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

1.2.5

1.3.0

1.3.1

1.3.2

1.3.20

1.3.21

1.3.22

1.3.23

1.3.24

1.3.25

1.3.26

1.3.27

1.3.28

1.3.29

1.3.3

1.3.32

1.3.33

1.3.34

1.3.35

1.3.36

1.3.4

1.3.5

1.3.6

1.3.7

1.3.8

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

1.5.0

1.5.1

1.5.2

1.6.0

1.6.1

1.6.2

1.6.3

1.6.4

1.6.5

1.6.6

1.6.7

1.6.8

1.7.0

1.7.1

1.7.4

1.7.5

1.7.6

1.7.7

1.8.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44668.json"