Search
Find a vulnerability
Search criteria
3 vulnerabilities found for classroomio by classroomio
CVE-2026-124551 (GCVE-0-2026-124551)
Vulnerability from cvelistv5 – Published: 2026-11-08 13:52 – Updated: 2026-11-08 13:52
VLAI
EPSS
VEX
Title
ClassroomIO through 1.0.0 Cross-Organization Course Disclosure via Clone Endpoint
Summary
ClassroomIO through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users of any organization to clone other tenants' courses via the POST /course/:courseId/clone endpoint. Attackers who know a target course id can copy its sections, lessons, exercises, and quiz answer keys into their own organization, exposing private course content.
Severity
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
7 references
| URL | Tags |
|---|---|
| https://github.com/classroomio/classroomio/issues/1414 | issue-tracking |
| https://github.com/classroomio/classroomio | product |
| https://github.com/classroomio/classroomio/commit… | patch |
| https://hackmd.io/@hieuPenguinnn/classroomio-cour… | technical-description |
| https://github.com/classroomio/classroomio/blob/v… | technical-description |
| https://github.com/classroomio/classroomio/blob/v… | technical-description |
| https://www.vulncheck.com/advisories/classroomio-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| classroomio | classroomio |
Affected:
0 , ≤ 1.0.0
(semver)
cpe:2.3:a:classroomio:classroomio:*:*:*:*:*:*:*:* |
Date Public
2026-10-22 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/classroomio/classroomio",
"product": "classroomio",
"vendor": "classroomio",
"versions": [
{
"lessThanOrEqual": "1.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:classroomio:classroomio:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Rotimi Best"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ClassroomIO through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users of any organization to clone other tenants\u0027 courses via the POST /course/:courseId/clone endpoint. Attackers who know a target course id can copy its sections, lessons, exercises, and quiz answer keys into their own organization, exposing private course content."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T13:52:34.322Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #1414",
"tags": [
"issue-tracking"
],
"url": "https://github.com/classroomio/classroomio/issues/1414"
},
{
"tags": [
"product"
],
"url": "https://github.com/classroomio/classroomio"
},
{
"tags": [
"patch"
],
"url": "https://github.com/classroomio/classroomio/commit/6630b73f8d53e316de6f575a170b093da6bf3cca"
},
{
"tags": [
"technical-description"
],
"url": "https://hackmd.io/@hieuPenguinnn/classroomio-course-clone-cross-org-content-exfiltration"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/routes/course/course.ts#L584-L612"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/services/course/clone.ts#L202-L290"
},
{
"name": "VulnCheck Advisory: ClassroomIO through 1.0.0 Cross-Organization Course Disclosure via Clone Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/classroomio-through-1.0.0-cross-organization-course-disclosure-via-clone-endpoint"
}
],
"title": "ClassroomIO through 1.0.0 Cross-Organization Course Disclosure via Clone Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-124551",
"datePublished": "2026-11-08T13:52:34.322Z",
"dateReserved": "2026-11-08T13:43:23.426Z",
"dateUpdated": "2026-11-08T13:52:34.322Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111369 (GCVE-0-2026-111369)
Vulnerability from cvelistv5 – Published: 2026-10-15 21:43 – Updated: 2026-10-16 17:08
VLAI
EPSS
VEX
Title
ClassroomIO through 1.0.0 Incorrect Authorization via Lesson Update and Delete Routes
Summary
ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson ids to change titles and stored HTML content or delete lessons in their course and in other courses and organizations.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:31 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/classroomio-cour… | third-party-advisory |
| https://github.com/classroomio/classroomio/blob/v… | technical-description |
| https://github.com/classroomio/classroomio/blob/v… | technical-description |
| https://github.com/classroomio/classroomio | product |
| https://www.vulncheck.com/advisories/classroomio-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| classroomio | ClassroomIO |
Affected:
0 , ≤ 1.0.0
(semver)
cpe:2.3:a:classroomio:classroomio:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111369",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:31:47.802897Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:08:02.709Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/classroomio/classroomio",
"product": "ClassroomIO",
"repo": "https://github.com/classroomio/classroomio",
"vendor": "classroomio",
"versions": [
{
"lessThanOrEqual": "1.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:classroomio:classroomio:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson ids to change titles and stored HTML content or delete lessons in their course and in other courses and organizations."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T21:43:52.330Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/classroomio-course-resource-id-scoping-idor"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/routes/course/lesson.ts#L107-L152"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/middlewares/course-member.ts"
},
{
"tags": [
"product"
],
"url": "https://github.com/classroomio/classroomio"
},
{
"name": "VulnCheck Advisory: ClassroomIO through 1.0.0 Incorrect Authorization via Lesson Update and Delete Routes",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/classroomio-through-1.0.0-incorrect-authorization-via-lesson-update-and-delete-routes"
}
],
"title": "ClassroomIO through 1.0.0 Incorrect Authorization via Lesson Update and Delete Routes",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111369",
"datePublished": "2026-10-15T21:43:52.330Z",
"dateReserved": "2026-10-15T21:21:32.069Z",
"dateUpdated": "2026-10-16T17:08:02.709Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111368 (GCVE-0-2026-111368)
Vulnerability from cvelistv5 – Published: 2026-10-15 21:43 – Updated: 2026-10-16 14:14
VLAI
EPSS
VEX
Title
ClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete Routes
Summary
ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another course's submission UUID to PUT or DELETE handlers to overwrite answers, grades, feedback, and grading status or delete submissions.
Severity
6.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 14:13 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
VulnCheck
CNA
References
6 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/classroomio-cour… | third-party-advisory |
| https://github.com/classroomio/classroomio/blob/v… | technical-description |
| https://github.com/classroomio/classroomio/blob/v… | technical-description |
| https://github.com/classroomio/classroomio/commit… | patch |
| https://github.com/classroomio/classroomio | product |
| https://www.vulncheck.com/advisories/classroomio-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| classroomio | ClassroomIO |
Affected:
0 , ≤ 1.0.0
(semver)
cpe:2.3:a:classroomio:classroomio:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111368",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T14:13:41.959968Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T14:14:38.123Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/classroomio-course-resource-id-scoping-idor"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/classroomio/classroomio",
"product": "ClassroomIO",
"repo": "https://github.com/classroomio/classroomio",
"vendor": "classroomio",
"versions": [
{
"lessThanOrEqual": "1.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:classroomio:classroomio:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another course\u0027s submission UUID to PUT or DELETE handlers to overwrite answers, grades, feedback, and grading status or delete submissions."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T21:43:51.616Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/classroomio-course-resource-id-scoping-idor"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/routes/course/submission.ts"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/classroomio/classroomio/blob/v1.0.0/packages/db/src/queries/submission/submission.ts#L217-L245"
},
{
"tags": [
"patch"
],
"url": "https://github.com/classroomio/classroomio/commit/1844ad9671a0d9c2566d3431d82f34d39016242c"
},
{
"tags": [
"product"
],
"url": "https://github.com/classroomio/classroomio"
},
{
"name": "VulnCheck Advisory: ClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete Routes",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/classroomio-through-1.0.0-idor-via-course-submission-update-grade-and-delete-routes"
}
],
"title": "ClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete Routes",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111368",
"datePublished": "2026-10-15T21:43:51.616Z",
"dateReserved": "2026-10-15T21:21:27.275Z",
"dateUpdated": "2026-10-16T14:14:38.123Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}