CVE-2026-86416: ILIAS Authorization Bypass Vulnerability

CVE-2026-86416 Overview

CVE-2026-86416 is an authorization bypass vulnerability in the ILIAS learning management system. The flaw exists in the ilObjGroupGUI component, where the saveMapSettingsObject() and updateGroupTypeObject() methods perform state-changing operations without verifying write permissions. Authenticated users with only read access to a group can craft POST requests to modify group map settings and didactic template assignments. This allows read-only members to change group modes and permissions for all other members. The vulnerability is classified as Missing Authorization [CWE-862] and affects ILIAS versions before 9.23, 10.11, and 11.4.

Critical Impact
Authenticated read-only users can modify group configuration, alter didactic templates, and change permissions for all group members.

Affected Products

ILIAS versions prior to 9.23
ILIAS versions prior to 10.11
ILIAS versions prior to 11.4

Discovery Timeline

2026-09-07 - CVE-2026-86416 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86416

Vulnerability Analysis

The vulnerability resides in the ilObjGroupGUI class inside components/ILIAS/Group/classes/class.ilObjGroupGUI.php. Two action methods, saveMapSettingsObject() and updateGroupTypeObject(), execute state-changing operations without calling checkPermission("write"). Any authenticated ILIAS user holding only read access on a group ref_id can invoke these endpoints. The action handlers proceed to persist configuration changes, including switching the didactic template through ilDidacticTemplateUtils::switchTemplate(). Because didactic templates control group mode and role permissions, a low-privileged user can alter access controls for every member of the target group. The impact is scoped to the affected group object, but cascades across all users assigned to that group.

Root Cause

The root cause is missing authorization enforcement [CWE-862] on privileged action handlers. ILIAS relies on the checkPermission() method to gate write operations, but this call was omitted from saveMapSettingsObject() and updateGroupTypeObject(). The GUI dispatcher routes POST requests to these methods based solely on authenticated session state and command name, not on the caller's effective RBAC rights for the target ref_id.

Attack Vector

An authenticated user with read-only membership in a group crafts a POST request to the vulnerable command endpoints. The request supplies parameters such as grp_type to trigger didactic template switching or map settings updates. The server processes the request without validating write permissions and commits the changes to the group object.

php

    public function updateGroupTypeObject(): void
    {
+       $this->checkPermission("write");
+
        ilDidacticTemplateUtils::switchTemplate(
            $this->object->getRefId(),
            (int) $_REQUEST['grp_type']

Source: ILIAS GitHub Commit 16bca71. The patch adds the missing checkPermission("write") guard before the state-changing switchTemplate() call.

Detection Methods for CVE-2026-86416

Indicators of Compromise

Unexpected changes to group didactic template assignments recorded in ILIAS audit logs.
POST requests to ilias.php containing cmdClass=ilObjGroupGUI with cmd=updateGroupType or cmd=saveMapSettings originating from users lacking write rights.
Unexplained shifts in group mode (open, closed, password-protected) or role permission changes for group members.

Detection Strategies

Correlate ILIAS application logs with RBAC data to identify write operations executed by users holding only read rights on the target ref_id.
Inspect web server access logs for POST requests targeting updateGroupTypeObject and saveMapSettingsObject command handlers.
Review database change history on grp_settings and didactic_tpl_a tables for modifications not attributable to authorized administrators.

Monitoring Recommendations

Enable verbose ILIAS action logging for group objects and forward events to a central log store for analysis.
Alert on any change to didactic template assignments and group mode transitions.
Baseline normal administrative activity per group and flag deviations, especially edits performed by non-admin accounts.

How to Mitigate CVE-2026-86416

Immediate Actions Required

Upgrade ILIAS to version 9.23, 10.11, or 11.4 as applicable to your deployment branch.
Audit recent changes to group didactic templates and map settings to identify unauthorized modifications.
Review the membership and role assignments for all groups that may have been targeted.

Patch Information

The fix adds the missing $this->checkPermission("write") call to updateGroupTypeObject() and saveMapSettingsObject() in class.ilObjGroupGUI.php. Apply the upstream patch documented in ILIAS GitHub Commit 16bca71 or upgrade to a fixed release. Additional vendor guidance is available in the VulnCheck Advisory on ILIAS and the ILIAS Blog Post #940.

Workarounds

Restrict group membership on shared instances to trusted users until the patch is applied.
Deploy a web application firewall rule that blocks POST requests to cmd=updateGroupType and cmd=saveMapSettings from non-administrative sessions.
Monitor and revert any unauthorized didactic template changes while the vulnerable version remains in production.

bash

# Example WAF rule (ModSecurity) blocking vulnerable command handlers
SecRule REQUEST_METHOD "@streq POST" \
    "chain,id:1026864160,phase:2,deny,status:403,log,msg:'Block ILIAS group action handlers'"
    SecRule ARGS:cmd "@rx ^(updateGroupType|saveMapSettings)$" \
        "chain"
        SecRule ARGS:cmdClass "@streq ilObjGroupGUI"