FACTION allows an attacker who has not logged in to read, overwrite, deactivate, or permanently delete any boilerplate template used to generate penetration testing reports. The vulnerability stems from the AccessControlInterceptor, which should guard all Struts2 actions but fails to verify a valid session. Additionally, four specific action methods in BoilerPlateConfig lack local session checks, compounding the oversight. This authentication bypass corresponds to CWE‑306 and can lead to arbitrary alterations of report generation logic, potentially inserting malicious content or disrupting collaboration efforts.

Versions of Faction older than 1.8.3 are affected. The security framework is sold by Faction Security, with the patch introduced in release 1.8.3.

The CVSS score of 9.8 indicates a critical severity. EPSS data is not available, so the likelihood of exploitation cannot be quantified from the provided metrics. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this weakness remotely by issuing HTTP requests to the already exposed Struts2 endpoints; no authentication credentials are required, implying that any user with network access to the Faction installation can execute the attack.