CVE-2026-86416
Received Received - Intake

Authorization Bypass in ILIAS Group Settings

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: VulnCheck

Description
ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject() and updateGroupTypeObject() perform state-changing operations without write permission checks. Authenticated users with only read access to a group can craft POST requests to modify group map settings and didactic template assignments, changing group modes and permissions for all members.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86416
EUVD
EUVD-2026-72363

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
ilias ilias to 9.23 (exc)
ilias ilias to 10.11 (exc)
ilias ilias to 11.4 (exc)
ilias elearning to 9.23|end_excluding=10.11|end_excluding=11.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in ILIAS versions before 9.23, 10.11, and 11.4. It occurs in the ilObjGroupGUI component where functions saveMapSettingsObject() and updateGroupTypeObject() allow state-changing operations without proper write permission checks. Authenticated users with only read access can exploit this to modify group settings and permissions via crafted POST requests.

Detection Guidance

To detect this vulnerability, inspect ILIAS installations for versions before 9.23, 10.11, or 11.4. Check the file components/ILIAS/Group/classes/class.ilObjGroupGUI.php for missing permission checks in saveMapSettingsObject() and updateGroupTypeObject(). Review server logs for POST requests to these functions from non-admin users.

Impact Analysis

An attacker with read-only access to a group could change group modes, permissions, or didactic template assignments. This could disrupt group functionality, expose sensitive data, or allow unauthorized actions by altering member permissions for all users in the group.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's data integrity and confidentiality requirements. For HIPAA, it may compromise protected health information integrity if group permissions are altered in healthcare-related ILIAS deployments.

Mitigation Strategies

Immediately update ILIAS to versions 9.23, 10.11, or 11.4 or later. If updating is not possible, apply the patch from commit 16bca712847f83440fa051cdbb15b38296357c79. Restrict network access to ILIAS admin interfaces and monitor for unauthorized POST requests to group-related endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86416. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart