Authorization Bypass Vulnerability in ILIAS eLearning Platform

CVE-2026-86416

What is CVE-2026-86416?

The ILIAS eLearning platform has a vulnerability in the ilObjGroupGUI component, which allows authenticated users with merely read access to perform actions that should be restricted. Specifically, functions like saveMapSettingsObject() and updateGroupTypeObject() do not implement adequate permission checks during critical operations. This oversight permits users to manipulate group settings and access permissions through crafted POST requests, potentially compromising the integrity and security of all group members' access levels.

References