Description
ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject() and updateGroupTypeObject() perform state-changing operations without write permission checks. Authenticated users with only read access to a group can craft POST requests to modify group map settings and didactic template assignments, changing group modes and permissions for all members.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ILIAS-eLearning e.V. | ILIAS | 9.0 – < 9.23, 10.0 – < 10.11, 11.0 – < 11.4 | 9.23 |
Advisories 1
- WID-SEC-2026-3179 ILIAS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 7, 2026
References
- ILIAS 11.4 Security Advisory (Mantis 0048260) vendor-advisory
- ILIAS 10.11 Security Advisory (Mantis 0048260) vendor-advisory
- ILIAS 9.23 Security Advisory (Mantis 0048260) vendor-advisory
- Group: add missing permission checks in GUI (48260) patch
- ilObjGroupGUI::updateGroupTypeObject() at v11.3 technical-description
- ilObjGroupGUI::saveMapSettingsObject() at v11.3 technical-description
- https://github.com/ILIAS-eLearning/ILIAS product
- VulnCheck Advisory: ILIAS before 9.23, 10.11, and 11.4 Missing Authorization in Group Object Action Methods third-party-advisory