Description
In Internet2 Grouper before 7.5.1 (in some configurations), a user who is allowed to create or edit rules in the User Interface can escalate privileges.
Published: 2026-09-30
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation
Action: Patch Now
AI Analysis

Impact

Internet2 Grouper versions before 7.5.1 contain a flaw that allows a user with permission to create or edit rules in the web interface to elevate privileges beyond what is intended. This improper privilege check corresponds to CWE-266. An attacker who can use the rule‑editing UI can gain higher rights, potentially accessing or modifying protected data.

Affected Systems

The vulnerability affects Internet2 Grouper distributed as a container, in any configuration that permits rule creation or editing through the user interface, for all releases prior to 7.5.1.

Risk and Exploitability

The CVSS score of 9.3 indicates high severity, and the vulnerability is not listed in CISA’s KEV catalog. EPSS data is unavailable, so the precise likelihood of exploitation is uncertain. The likely attack vector is the web interface, where a user with rule‑creation privileges can exploit the flaw; no additional conditions are stated in the description.

Generated by OpenCVE AI on September 30, 2026 at 19:21 UTC.

Remediation

Vendor Solution

Upgrade to fixed container version

Vendor Workaround

Turn off rules in UI for non-admins

OpenCVE Recommended Actions

  • Upgrade to the fixed container version of Internet2 Grouper
  • Disable rule creation and editing features for non‑administrative users through the UI
  • Restrict role‑based access control to ensure only administrators can manage rules

Generated by OpenCVE AI on September 30, 2026 at 19:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 30 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
Title Privilege Escalation via Rule Editing in Internet2 Grouper

Wed, 30 Sep 2026 16:00:00 +0000

Type Values Removed Values Added
Description In Internet2 Grouper before 7.5.1 (in some configurations), a user who is allowed to create or edit rules in the User Interface can escalate privileges.
First Time appeared Internet2
Internet2 grouper
Weaknesses CWE-266
CPEs cpe:2.3:a:internet2:grouper:*:*:*:*:*:*:*:*
Vendors & Products Internet2
Internet2 grouper
References
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:N/R:U/RE:L/U:Red'}

Subscriptions

Internet2 Grouper
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-09-30T19:06:00.204Z

Reserved: 2026-09-30T15:52:59.863Z

Link: CVE-2026-103470

cve-icon Vulnrichment

Updated: 2026-09-30T18:42:12.790Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-30T16:17:10.230

Modified: 2026-09-30T19:16:40.507

Link: CVE-2026-103470

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T00:45:07Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment