The vulnerability CVE-2026-44668 affects factionsecurity's 'faction' product versions prior to 1.8.3. The core issue is a missing authentication check in the AccessControlInterceptor, which unconditionally calls invocation.invoke() without validating user sessions. Furthermore, four action methods in BoilerPlateConfig do not perform local session validation. This allows unauthenticated attackers to perform unauthorized operations on boilerplate templates, including reading, overwriting, deactivating, and permanently deleting them. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function) and has a CVSS 3.1 base score of 9.8, reflecting critical severity. The issue is resolved in version 1.8.3 of the product.

An unauthenticated attacker can exploit this vulnerability to fully compromise boilerplate templates within the factionsecurity faction product, leading to complete loss of confidentiality, integrity, and availability of these templates. This could disrupt operations relying on these templates and potentially affect the overall security posture of the system using the vulnerable versions.

Upgrade to factionsecurity faction product version 1.8.3 or later, where this vulnerability is fixed. Since the vendor advisory indicates the issue is resolved in 1.8.3, applying this official fix is the recommended remediation. Patch status is confirmed by the vendor advisory stating the fix is included in version 1.8.3. No additional mitigations are specified.