CVE-2026-86416 ILIAS-eLearning e.V. CVE debrief

Who should care

Defenders and administrators of ILIAS learning management systems, particularly those with versions before 9.23, 10.11, and 11.4, should assess exposure and apply patches or updates.

Why it matters

CVE-2026-86416 is a medium-severity authorization bypass vulnerability in ILIAS learning management system versions before 9.23, 10.11, and 11.4. Authenticated users with read-only access can modify group settings and permissions, potentially changing group modes and permissions for all members. Defenders should prioritize verifying exposure and applying patches.

• An attacker can modify group map settings and didactic template assignments, changing group modes and permissions for all members.
• Defenders need to verify exposure and apply patches to prevent potential unauthorized changes.
• The vulnerability requires authentication but only read access to a group, making it a concern for systems with multiple user roles.

Technical summary

The vulnerability exists in the ilObjGroupGUI class, specifically in the saveMapSettingsObject() and updateGroupTypeObject() methods, which perform state-changing operations without write permission checks. This allows authenticated users with read-only access to modify group settings and permissions, potentially changing group modes and permissions for all members. The affected product is ILIAS learning management system versions before 9.23, 10.11, and 11.4. Defenders should prioritize verifying exposure and applying patches, focusing on restricting access to group settings and ensuring proper authorization checks.

Defensive priority

Defenders should prioritize verifying exposure and applying patches, focusing on restricting access to group settings and ensuring proper authorization checks.

Recommended defensive actions

• Verify ILIAS version and check for exposure
• Restrict access to group settings and ensure proper authorization checks
• Apply patches or updates to affected versions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the corpus lacks specific information on exploitation, victims, or business impact. The vulnerability requires authentication but only read access to a group, making it a concern for systems with multiple user roles. There are references to the ILIAS GitHub repository and specific code changes that address the vulnerability. Defenders need to verify exposure and apply patches to prevent potential unauthorized changes. The CVE Program record and NVD detail page

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.