Internet2 Grouper: Privilege escalation through UI rule editing
Summary
Internet2 Grouper in the affected ranges lets a user who can create or edit rules in the Grouper user interface escalate privileges. The attacker needs a valid account with rule-editing rights, and the issue only applies where non-sysadmin users can edit rules. CVSS 4.0 rates it 9.3 (critical) for the worst case, but CISA SSVC reports no known exploitation.
Affected
- Internet2 Grouper 5.8.3 to 5.22.5 (per CNA record; third-party sources disagree on this range)
- Internet2 Grouper 6.0.0 to before 6.4.1
- Internet2 Grouper 7.0.0 to before 7.5.1
- Default configuration: not affected
Fixed in
- The CVE description states the issue is fixed in 7.5.1.
- Patched releases for the 5.x and 6.x branches: Unknown.
Workaround
- Restrict the rules UI to Grouper sysadmins with the setting rules.restrictRulesUiToMembersOfThisGroupName in grouper.properties.
- The settings rules.groupNamesRestrictRules and rules.stemNamesRestrictRules help only partly.
- Restricting the UI does not remove existing rules; review them manually.
Exploitation
- CISA SSVC: exploitation none, not automatable.
- Not listed as known exploited (KEV: no).
- No public proof of concept found at the time of writing.
- EPSS score 0.00255 (low), per Vulners.
Our recommendation
- Check whether Grouper is deployed and which version and branch is in use.
- If it is, restrict rule editing in the UI to sysadmins and review existing rules for unexpected entries.
- Obtain a patched release for your branch from the vendor; do not assume one exists.
- Monitor NVD and the vendor advisory, as NVD analysis was still pending.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Vendor advisory GRP-7359 (Internet2) docs.grouper.internet2.edu
- OSV: CVE-2026-103470 osv.dev
- Threatint CVE record cve.threatint.com
- Vulners (MEND) CVE-2026-103470 vulners.com
- Strix CVE-2026-103470 www.strix.ai
- HOL Guard: CISA ADP Vulnrichment hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:47.
Original description (NVD)
In Internet2 Grouper before 7.5.1 (in some configurations), a user who is allowed to create or edit rules in the User Interface can escalate privileges.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.