Description
In Internet2 Grouper before 7.5.1 (in some configurations), a user who is allowed to create or edit rules in the User Interface can escalate privileges.
Published: 2026-09-30
Score: 9.3 Critical
EPSS: n/a
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

Upgrade to fixed container version

Vendor Workaround

Turn off rules in UI for non-admins

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 30 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
Title Privilege Escalation via Rule Editing in Internet2 Grouper

Wed, 30 Sep 2026 16:00:00 +0000

Type Values Removed Values Added
Description In Internet2 Grouper before 7.5.1 (in some configurations), a user who is allowed to create or edit rules in the User Interface can escalate privileges.
First Time appeared Internet2
Internet2 grouper
Weaknesses CWE-266
CPEs cpe:2.3:a:internet2:grouper:*:*:*:*:*:*:*:*
Vendors & Products Internet2
Internet2 grouper
References
Metrics cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:N/R:U/RE:L/U:Red'}

Subscriptions

Internet2 Grouper
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-09-30T19:06:00.204Z

Reserved: 2026-09-30T15:52:59.863Z

Link: CVE-2026-103470

cve-icon Vulnrichment

Updated: 2026-09-30T18:42:12.790Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-30T16:17:10.230

Modified: 2026-09-30T19:16:40.507

Link: CVE-2026-103470

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T19:30:18Z

Weaknesses