ILIAS before 9.23, 10.11, and 11.4 Missing Authorization in Group Object Action Methods
Priority LOW 24CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject() and updateGroupTypeObject() perform state-changing operations without write permission checks. Authenticated users with only read access to a group can craft POST requests to modify group map settings and didactic template assignments, changing group modes and permissions for all members.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00446 38th percentileScored 2026-11-07
Fix Fixed ILIAS (ILIAS-eLearning e.V.): 9.23, 10.11, 11.4
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ILIAS-eLearning e.V. | ILIAS | 9.0 to before 9.23; 10.0 to before 10.11; 11.0 to before 11.4 | 9.23, 10.11, 11.4 | Patch available | CNA |
- ILIAS VendorILIAS-eLearning e.V. Affected 9.0 to before 9.23; 10.0 to before 10.11; 11.0 to before 11.4 Fixed in 9.23, 10.11, 11.4 Patch available CNA
Remediation
- Fix · CNA ILIAS (ILIAS-eLearning e.V.) Fixed in 9.23, 10.11, 11.4
Timeline
- 2026-10-02 Threatist record created from CVE-2026-86416
- 2026-10-03 Alias added: GHSA-4976-qg89-r3vv
References
Advisory 3
More ILIAS-eLearning e.V. vulnerabilities
- TI-2026-55506 ILIAS PHP Object Injection via Shibboleth Logout CVSS 4.0CRITICAL 9.3
- TI-2026-70090 Unrestricted file upload in ILIAS QTI import lets authors run code CVSS 4.0HIGH 8.7
- TI-2026-69589 Argument injection in ILIAS image map uploads enables code execution CVSS 4.0HIGH 8.7
- TI-2026-56895 ILIAS Arbitrary SQL Injection via Repository Trash Table Sort Parameter CVSS 4.0HIGH 8.7
- TI-2026-74420 PHP object injection in ILIAS test results import CVSS 4.0HIGH 8.7
- TI-2026-57181 ILIAS Arbitrary File Read via SOAP addFile CVSS 4.0HIGH 7.1
Sources
- CVE-2026-86416 · CVE Program
- CVE-2026-86416 · NVD
- FIRST EPSS
- GHSA-4976-qg89-r3vv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences