Internet2 Grouper EUVD-2026-90161

Requires an authenticated Grouper account that has been granted permission to create or edit rules in the Grouper User Interface - a delegated administrative capability, not a default privilege for ordinary users. Exploitation is further limited to 'some configurations' of Grouper before 7.5.1 (per the description), so default or hardened deployments may not be vulnerable. The vendor vector's UI:A implies a separate active user interaction may be needed to trigger the crafted rule's effect. Limiting factors: pre-existing rule-management authorization (PR:L), a specific non-default configuration, and affected version below 7.5.1.

This is a genuine privilege-escalation flaw (CWE-266) in Internet2 Grouper before 7.5.1, but real-world risk is moderated by several factors that conflict with the headline 9.3 'critical' score. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A) confirms the attacker must already be an authenticated Grouper user (PR:L) who specifically holds permission to create or edit rules in the UI - this is not an anonymous internet attacker but a semi-trusted insider or a compromised delegated account. The description further limits scope with 'in some configurations,' meaning default deployments may not be exploitable; the 9.3 rating is driven largely by the CVSS 4.0 subsequent-system impact metrics (SC:H/SI:H/SA:H), reflecting that Grouper governs access to downstream systems, so escalation here cascades. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: a real priority for organizations that delegate rule-editing rights broadly, but the high score overstates risk for hardened/default configs - the prerequisite of an existing rule-editing privilege is the key limiting control. Note the UI:A (active interaction) element in the vendor vector suggests the escalation may require a separate user/admin action to trigger the crafted rule; this should be verified with the vendor advisory.

An authenticated Grouper user who has been delegated the ability to create or edit rules in the web UI crafts a malicious rule (e.g., one that auto-assigns group memberships or admin privileges to their own account) in a vulnerable configuration. When the rule executes, the attacker gains elevated privileges within Grouper and, by extension, over the access decisions Grouper feeds to downstream systems. No public exploit code is available, and exploitation requires pre-existing rule-management rights.