CVE-2026-86416 — ILIAS before 9.23, 10.11, and 11.4 Missing Authorization in Group Object Action Methods
ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject() and updateGroupTypeObject() perform stat…
Published: 2026-09-07 · CVSS: 5.3 · CVSS 4.0
ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject() and updateGroupTypeObject() perform state-changing operations without write permission checks. Authenticated users with only read access to a group can craft POST requests to modify group map settings and didactic template assignments, changing group modes and permissions for all members.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7