{"id":"CVE-2026-103470","details":"In Internet2 Grouper before 7.5.1 (in some configurations), a user who is allowed to create or edit rules in the User Interface can escalate privileges.","modified":"2026-10-02T03:47:01.611726241Z","published":"2026-09-30T15:53:00.372Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103470.json","cna_assigner":"mitre","cwe_ids":["CWE-266"]},"references":[{"type":"WEB","url":"https://docs.grouper.internet2.edu/wiki/spaces/Grouper/pages/240549893/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103470.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103470"},{"type":"PACKAGE","url":"https://github.com/Internet2/grouper"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/internet2/grouper","events":[{"introduced":"476c973460df303c7b697f1268efb9a00b24e6c8"},{"last_affected":"2ba04e3584b8c749c488f7e480c2346f4d7a2eff"},{"introduced":"5afebe85dd435ed7fa368941eb6d0113adcd4930"},{"fixed":"22d7a30ca3f1ce756a1ef8640b5e1cb68f726b36"},{"introduced":"f890537ebadd8e414e87bb6d69e8b856ed07d367"},{"fixed":"63e1e2cf88505aed3d79f97b94876887dca3c201"}],"database_specific":{"extracted_events":[{"introduced":"5.8.3"},{"last_affected":"5.22.5"},{"introduced":"6.0.0"},{"fixed":"6.4.1"},{"introduced":"7.0.0"},{"fixed":"7.5.1"}],"source":"AFFECTED_FIELD"}}],"versions":["GROUPER_RELEASE_7.5.0","GROUPER_RELEASE_6.4.0","GROUPER_RELEASE_6.3.0","GROUPER_RELEASE_7.4.0","GROUPER_RELEASE_7.3.2","GROUPER_RELEASE_6.2.0","GROUPER_RELEASE_7.3.1","GROUPER_RELEASE_7.3.0","GROUPER_RELEASE_7.2.1","GROUPER_RELEASE_7.2.0","GROUPER_RELEASE_6.1.1","GROUPER_RELEASE_7.0.0","GROUPER_RELEASE_6.1.0","GROUPER_RELEASE_6.0.1","GROUPER_RELEASE_6.0.0","GROUPER_RELEASE_5.22.5","GROUPER_RELEASE_5.22.3","GROUPER_RELEASE_5.22.2","GROUPER_RELEASE_5.22.1","GROUPER_RELEASE_5.22.0","GROUPER_RELEASE_5.21.3","GROUPER_RELEASE_5.21.2","GROUPER_RELEASE_5.21.1","GROUPER_RELEASE_5.21.0","GROUPER_RELEASE_5.20.6","GROUPER_RELEASE_5.20.4","GROUPER_RELEASE_5.20.3","GROUPER_RELEASE_5.20.2","GROUPER_RELEASE_5.20.1","GROUPER_RELEASE_5.20.0","GROUPER_RELEASE_5.19.2","GROUPER_RELEASE_5.19.1","GROUPER_RELEASE_5.19.0","GROUPER_RELEASE_5.18.3","GROUPER_RELEASE_5.18.2","GROUPER_RELEASE_5.18.1","GROUPER_RELEASE_5.17.2","GROUPER_RELEASE_5.17.1","GROUPER_RELEASE_5.17.0","GROUPER_RELEASE_5.16.0","GROUPER_RELEASE_5.15.5","GROUPER_RELEASE_5.15.4","GROUPER_RELEASE_5.15.2","GROUPER_RELEASE_5.15.1","GROUPER_RELEASE_5.15.0","GROUPER_RELEASE_5.14.1","GROUPER_RELEASE_5.14.0","GROUPER_RELEASE_5.13.2","GROUPER_RELEASE_5.13.1","GROUPER_RELEASE_5.13.0","GROUPER_RELEASE_5.12.2","GROUPER_RELEASE_5.12.1","GROUPER_RELEASE_5.12.0","GROUPER_RELEASE_5.11.2","GROUPER_RELEASE_5.11.1","GROUPER_RELEASE_5.11.0","GROUPER_RELEASE_5.10.1","GROUPER_RELEASE_5.10.0","GROUPER_RELEASE_5.9.1","GROUPER_RELEASE_5.9.0","GROUPER_RELEASE_5.8.7","GROUPER_RELEASE_5.8.4","GROUPER_RELEASE_5.8.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103470.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/AU:N/R:U/RE:L/U:Red"}]}