Description

ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject() and updateGroupTypeObject() perform state-changing operations without write permission checks. Authenticated users with only read access to a group can craft POST requests to modify group map settings and didactic template assignments, changing group modes and permissions for all members.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-07T13:20:40.233Z",
  "pubdate": "2026-09-07T13:20:40.233Z",
  "executiveSummary": "ILIAS versions before 9.23, 10.11, and 11.4 are susceptible to an authorization bypass vulnerability within the ilObjGroupGUI component.\nThe vulnerability stems from inadequate access control checks during state-changing operations, specifically within the saveMapSettingsObject() and updateGroupTypeObject() functions.\nAn authenticated user possessing only read-level permissions for a specific group can leverage this flaw to execute unauthorized administrative actions.\nBy crafting malicious POST requests, an attacker can modify group map settings and didactic template assignments, effectively overriding established group modes and permission structures.\nThis vulnerability poses a significant risk to the integrity and confidentiality of group configurations within the ILIAS environment, allowing unauthorized users to alter group dynamics and member access controls.\nSuccessful exploitation requires authenticated access to the system, but does not necessitate elevated administrative privileges, making it a critical concern for multi-user ILIAS installations.",
  "technicalDetails": "The root cause of this vulnerability lies in the missing implementation of rigorous authorization checks within the ilObjGroupGUI class of ILIAS. Specifically, the methods saveMapSettingsObject() and updateGroupTypeObject() fail to verify whether the initiating user possesses the requisite write permissions before committing changes to the backend database.\nIn the standard ILIAS permission model, an authenticated user with 'read' access is restricted from performing operations that alter group settings or logical structures. However, these specific functions treat incoming requests as trusted commands without enforcing the checkPermission() guard clause typically required for state-changing administrative operations.\nThe attack flow proceeds as follows: 1) An attacker with authenticated 'read' access to a target group identifies the endpoints associated with the ilObjGroupGUI interface. 2) The attacker constructs a POST request targeting saveMapSettingsObject() or updateGroupTypeObject(). 3) Since the backend logic fails to validate the user's role against the required write-permission scope, the application processes the request. 4) The payload included in the POST request effectively alters the group's configuration, such as modifying map settings or didactic template assignments. 5) The changes are persisted to the system, resulting in an unauthorized modification of the group's mode and existing permission definitions.\nThe impact of this exploitation is substantial. By manipulating the group type and associated didactic templates, an attacker can escalate their own privileges within the group, potentially gaining elevated access that was never intended by the group administrators. Furthermore, because these changes affect all members of the group, the attacker can systematically degrade or bypass security controls globally within the affected group, leading to potential unauthorized data access or disruption of group-based activities.\nThe vulnerability affects all ILIAS instances running versions prior to 9.23, 10.11, and 11.4. The exposure is limited to authenticated users; however, in environments with self-registration or widespread access, this represents a major security weakness. The vulnerability highlights a failure in secure coding practices where input validation was prioritized over robust server-side authorization enforcement, allowing legitimate HTTP methods to be abused for unauthorized administrative state transitions."
}