EUVD-2026-31944Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (GitHub_M) · only source for this CVE.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, AccessControlInterceptor, the authentication gate for all Struts2 actions, unconditionally calls invocation.invoke() without checking for a valid session. Four action methods in BoilerPlateConfig perform no local session check either, allowing an unauthenticated attacker to read, overwrite, deactivate, and permanently delete any boilerplate template in the system. This vulnerability is fixed in 1.8.3.
AnalysisAI
Unauthenticated authorization bypass in FACTION pentesting report framework prior to 1.8.3 allows remote attackers to read, modify, deactivate, and delete any boilerplate report template without credentials. The flaw stems from AccessControlInterceptor invoking actions without session validation, compounded by four BoilerPlateConfig action methods that perform no local auth check. No public exploit identified at time of analysis, though EPSS is low (0.15%) and SSVC rates exploitation as POC with total technical impact.
Technical ContextAI
FACTION is a Struts2-based collaboration platform used by penetration testing teams to author and manage engagement reports. The root cause is CWE-306 (Missing Authentication for Critical Function): the AccessControlInterceptor, which functions as the global auth gate for all Struts2 actions, unconditionally calls invocation.invoke() without verifying that the request carries a valid session. This interceptor weakness is amplified because four specific action handlers in the BoilerPlateConfig class (tempDelete, tempActive, globalSaveTemplate, searchTemplateDetail per the 1.8.3 release notes) also omit their own session checks, leaving template CRUD operations fully exposed. The affected CPE is cpe:2.3:a:factionsecurity:faction:*:*:*:*:*:*:*:* across all versions before 1.8.3.
RemediationAI
Vendor-released patch: upgrade to FACTION 1.8.3, which both closes the AccessControlInterceptor gap for non-root namespaces (e.g. /portal/*) by redirecting unauthenticated requests to the login page and adds explicit session checks plus per-user scoping to the four BoilerPlateConfig actions (tempDelete, tempActive, globalSaveTemplate, searchTemplateDetail); see https://github.com/factionsecurity/faction/releases/tag/1.8.3 and the advisory at https://github.com/factionsecurity/faction/security/advisories/GHSA-7cv6-h22r-2qf2. If immediate upgrade is not possible, restrict network reachability of the FACTION application server to a VPN or trusted source IPs and block external access to the BoilerPlateConfig action endpoints at a reverse proxy or WAF - accepting that this will break any legitimate remote access path until users connect through the allowed channel.
FACTION is a PenTesting Report Generation and Collaboration Framework. Rated critical severity (CVSS 9.6), this vulnerab
Stored cross-site scripting in Faction (a penetration testing report generation and collaboration framework) versions pr
Stored cross-site scripting in Faction penetration testing platform versions prior to 1.8.3 allows authenticated users t
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today