Read the docs
TI-2026-65699 Aliases CVE-2026-103470GHSA-p48v-qg54-9c45

In Internet2 Grouper before 7.5.1 (in some configurations), a user who is allowed to…

Priority MEDIUM 42CWE-266Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-266.

Summary

In Internet2 Grouper before 7.5.1 (in some configurations), a user who is allowed to create or edit rules in the User Interface can escalate privileges.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00255 17th percentileScored 2026-11-07
Fix Fixed Grouper (Internet2): 6.4.1, 7.5.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Internet2Grouper5.8.3 – 5.22.5; 6.0.0 to before 6.4.1; 7.0.0 to before 7.5.16.4.1, 7.5.1Patch availableCNA
  • Grouper VendorInternet2 Affected 5.8.3 – 5.22.5; 6.0.0 to before 6.4.1; 7.0.0 to before 7.5.1 Fixed in 6.4.1, 7.5.1 Patch available CNA

Remediation

  • Fix · CNA Grouper (Internet2) Fixed in 6.4.1, 7.5.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-103470
  2. 2026-10-03 Alias added: GHSA-p48v-qg54-9c45

References

Other 1

  • TI-2025-37174 In Internet2 Grouper 5.17.1 before 5.20.5, group admins who are not Grouper sysadmins can configure loader jobs. CVSS 3.1MEDIUM 6.5
  • TI-2009-03314 Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider… CVSS 2.0HIGH 9.3
  • TI-2009-03312 OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2… CVSS 2.0HIGH 7.5
  • TI-2009-03313 Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and 2.x before 2.2.1… CVSS 2.0HIGH 7.5
  • TI-2018-14017 Cross-site scripting (XSS) vulnerability in UiV2Public.index in Internet2 Grouper 2.2 and… CVSS 3.0MEDIUM 6.1
  • TI-2013-05393 The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML… CVSS 2.0MEDIUM 5.0
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences