CVE-2026-86416 PUBLISHED

ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject() and updateGroupTypeObject() perform state-changing operations without write permission checks. Authenticated users with only read access to a group can craft POST requests to modify group map settings and didactic template assignments, changing group modes and permissions for all members.

• Siyang Wu finder

• ILIAS 11.4 Security Advisory (Mantis 0048260)
• ILIAS 10.11 Security Advisory (Mantis 0048260)
• ILIAS 9.23 Security Advisory (Mantis 0048260)
• Group: add missing permission checks in GUI (48260)
• ilObjGroupGUI::updateGroupTypeObject() at v11.3
• ilObjGroupGUI::saveMapSettingsObject() at v11.3
• https://github.com/ILIAS-eLearning/ILIAS
• VulnCheck Advisory: ILIAS before 9.23, 10.11, and 11.4 Missing Authorization in Group Object Action Methods

• Missing Authorization CWE