CVE-2026-86416: Missing Authorization in ILIAS-eLearning e.V. ILIAS

CVE-2026-86416 is an authorization bypass vulnerability affecting ILIAS eLearning software versions prior to 9.23, 10.11, and 11.4. The vulnerability exists in the ilObjGroupGUI class where the methods saveMapSettingsObject() and updateGroupTypeObject() perform state-changing operations without verifying that the user has write permissions. Authenticated users with read-only access can exploit this by crafting POST requests to modify group map settings and didactic template assignments, thereby altering group modes and permissions for all members.

An attacker with authenticated read-only access to a group can escalate privileges within that group by changing settings and permissions that should require write access. This could lead to unauthorized modification of group configurations and potentially disrupt group operations or grant unintended privileges to group members.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users and monitor for unusual group configuration changes. Avoid granting unnecessary read access to sensitive groups.