CVE-2026-44668 Details

A vulnerability in FACTION, a PenTesting report generation and collaboration framework, allows unauthenticated attackers to access, modify, and delete boilerplate templates. This issue arises because the AccessControlInterceptor, which manages authentication for Struts2 actions, fails to verify session validity before invoking action methods. As a result, four methods in BoilerPlateConfig can be exploited without authentication, enabling attackers to read, overwrite, deactivate, and permanently delete any template in the system.

To address this vulnerability, add a session check in the AccessControlInterceptor to reject unauthenticated requests before they reach the action methods. Additionally, each BoilerPlateConfig action method should include a session verification and, for template detail lookups, an ownership check.