EUVD-2026-31944Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionGitHub Advisory
FACTION is a PenTesting Report Generation and Collaboration Framework. Prior to 1.8.3, AccessControlInterceptor, the authentication gate for all Struts2 actions, unconditionally calls invocation.invoke() without checking for a valid session. Four action methods in BoilerPlateConfig perform no local session check either, allowing an unauthenticated attacker to read, overwrite, deactivate, and permanently delete any boilerplate template in the system. This vulnerability is fixed in 1.8.3.
AnalysisAI
Unauthenticated authorization bypass in FACTION pentesting report framework prior to 1.8.3 allows remote attackers to read, modify, deactivate, and delete any boilerplate report template without credentials. The flaw stems from AccessControlInterceptor invoking actions without session validation, compounded by four BoilerPlateConfig action methods that perform no local auth check. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against default configurations of FACTION versions before 1.8.3, requiring only network reachability to the Struts2 application's BoilerPlateConfig action endpoints (tempDelete, tempActive, globalSaveTemplate, searchTemplateDetail). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed but lean toward elevated risk for any internet-exposed FACTION instance. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who locates an internet-exposed FACTION instance issues unauthenticated HTTP requests directly to the BoilerPlateConfig action endpoints (such as tempDelete) and proceeds to enumerate, exfiltrate, overwrite, or wipe every boilerplate report template in the system, destroying institutional pentest reporting content or seeding malicious template language that later appears in client deliverables. SSVC classifies exploitation as automatable, so a simple script could iterate template IDs across many hosts; no PoC has been published, but the vendor's release notes describe the affected method names directly. |
| Remediation | Vendor-released patch: upgrade to FACTION 1.8.3, which both closes the AccessControlInterceptor gap for non-root namespaces (e.g. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Audit all FACTION installations, document current versions deployed, and create backup inventory of existing report templates. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today