CVE-2026-44668

Name of the Vulnerable Software and Affected Versions FACTION versions prior to 1.8.3

Description The AccessControlInterceptor, which serves as the authentication gate for all Struts2 actions, fails to verify the existence of a valid session before calling invocation.invoke(). Additionally, four action methods within BoilerPlateConfig lack local session validation. This allows an unauthenticated attacker to read, overwrite, deactivate, and permanently delete any boilerplate template within the system.

Recommendations Update to version 1.8.3.