CVE-2026-86416

ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject and updateGroupTypeObject perform state-changing operations without write permission checks. Authenticated users with only read access to a group can craft POST...

CVE-2026-86416 ILIAS before 9.23, 10.11, and 11.4 Missing Authorization in Group Object Action Methods

ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject and updateGroupTypeObject perform state-changing operations without write permission checks. Authenticated users with only read access to a group can craft POST...

EUVD-2026-72363

ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject and updateGroupTypeObject perform state-changing operations without write permission checks. Authenticated users with only read access to a group can craft POST...

CVE-2026-86416 ILIAS before 9.23, 10.11, and 11.4 Missing Authorization in Group Object Action Methods

ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject and updateGroupTypeObject perform state-changing operations without write permission checks. Authenticated users with only read access to a group can craft POST...

CVE-2026-86416 ILIAS before 9.23, 10.11, and 11.4 Missing Authorization in Group Object Action Methods

ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject and updateGroupTypeObject perform state-changing operations without write permission checks. Authenticated users with only read access to a group can craft POST...

CVE-2026-86416

ILIAS is an e-learning platform affected by an authorization bypass in the ilObjGroupGUI component prior to versions 9.23, 10.11, and 11.4 . The methods saveMapSettingsObject() and updateGroupTypeObject() perform state-changing operations without verifying write permissions, allowing any authenti...

CVE-2026-86416: Missing Authorization

ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject and updateGroupTypeObject perform state-changing operations without write permission checks. Authenticated users with only read access to a group can craft POST...

PT-2026-86766

ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject and updateGroupTypeObject perform state-changing operations without write permission checks. Authenticated users with only read access to a group can craft POST...