An authorization bypass was found in the group management interface of ILIAS where two state‑changing methods, saveMapSettingsObject() and updateGroupTypeObject(), lack proper write permission checks. Users who are only granted read access to a group can send crafted POST requests to alter map settings and didactic template assignments. The result is a change in group modes and permissions that applies to all group members, effectively letting a low‑privilege user control a group’s behaviour. This flaw corresponds to CWE‑862, Unauthorized Access to a Object or Resource.

The vulnerability affects all installations of ILIAS eLearning e.V. ILIAS versions earlier than 9.23, 10.11, and 11.4. Only those releases that include the class ilObjGroupGUI without the recent patch are impacted. The problem originates in the Group component; any site using the default group functionality is at risk.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, implying lower observed exploitation activity. The likely attack vector is a web‑based POST request to the affected GUI endpoints, requiring the attacker to possess an authenticated session with at least read access to a target group. Compromise will not provide code execution but grants unilateral modification of group policies and permissions.