{"id":"CVE-2026-86416","title":"ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject() and updateGroupTypeObject() perform state-changing operations without write permission checks","summary":"ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject() and updateGroupTypeObject() perform state-changing operations without write permission checks. Authe…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","cwe":["CWE-862"],"vendor":"ILIAS-eLearning e.V.","product":"ILIAS","affected":["ILIAS >= 9.0 < 9.23","ILIAS >= 10.0 < 10.11","ILIAS >= 11.0 < 11.4"],"published":"2026-09-07","updated":"2026-09-18","sourceUpdated":"2026-09-18T18:17:18.920","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86416","references":[{"url":"https://docu.ilias.de/ilias.php?baseClass=ilrepositorygui&cmdNode=wy:ll:6t&cmdClass=ilBlogPostingGUI&cmd=previewFullscreen&ref_id=15821&blpg=940","label":"disclosure@vulncheck.com"},{"url":"https://docu.ilias.de/ilias.php?baseClass=ilrepositorygui&cmdNode=wy:ll:6t&cmdClass=ilBlogPostingGUI&cmd=previewFullscreen&ref_id=15821&blpg=941","label":"disclosure@vulncheck.com"},{"url":"https://docu.ilias.de/ilias.php?baseClass=ilrepositorygui&cmdNode=wy:ll:6t&cmdClass=ilBlogPostingGUI&cmd=previewFullscreen&ref_id=15821&blpg=942","label":"disclosure@vulncheck.com"},{"url":"https://github.com/ILIAS-eLearning/ILIAS","label":"disclosure@vulncheck.com"},{"url":"https://github.com/ILIAS-eLearning/ILIAS/blob/v11.3/components/ILIAS/Group/classes/class.ilObjGroupGUI.php#L560-L569","label":"disclosure@vulncheck.com"},{"url":"https://github.com/ILIAS-eLearning/ILIAS/blob/v11.3/components/ILIAS/Group/classes/class.ilObjGroupGUI.php#L830-L858","label":"disclosure@vulncheck.com"},{"url":"https://github.com/ILIAS-eLearning/ILIAS/commit/16bca712847f83440fa051cdbb15b38296357c79","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/ilias-before-9.23-10.11-and-11.4-missing-authorization-in-group-object-action-methods","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"epss":0.00446,"epssPercentile":0.36025,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-18T17:08:48.596258Z"},"ingestedAt":"2026-09-08T20:10:03.179Z","slug":"CVE-2026-86416","body":"## Overview\n\nILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject() and updateGroupTypeObject() perform state-changing operations without write permission checks. Authenticated users with only read access to a group can craft POST requests to modify group map settings and didactic template assignments, changing group modes and permissions for all members.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}