Vulnerability · Published Sep 7, 2026 · Assigned by VulnCheck

CVE-2026-86416ILIAS before 9.23, 10.11, and 11.4 Missing Authorization in Group Object Action Methods

Medium 5.4

In plain English

A medium-severity missing authorization in ILIAS from ILIAS-eLearning e.V.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.4%top 61.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject() and updateGroupTypeObject() perform state-changing operations without write permission checks. Authenticated users with only read access to a group can craft POST requests to modify group map settings and didactic template assignments, changing group modes and permissions for all members.

Affected products (as reported)

Vendor	Product	Versions
ILIAS-eLearning e.V.	ILIAS	9.0 – before 9.2310.0 – before 10.1111.0 – before 11.4

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References

ILIAS 11.4 Security Advisory (Mantis 0048260) vendor-advisory
ILIAS 10.11 Security Advisory (Mantis 0048260) vendor-advisory
ILIAS 9.23 Security Advisory (Mantis 0048260) vendor-advisory
Group: add missing permission checks in GUI (48260) patch
ilObjGroupGUI::updateGroupTypeObject() at v11.3 technical-description
ilObjGroupGUI::saveMapSettingsObject() at v11.3 technical-description
https://github.com/ILIAS-eLearning/ILIAS product
VulnCheck Advisory: ILIAS before 9.23, 10.11, and 11.4 Missing Authorization in Group Object Action Methods third-party-advisory