CVE-2026-111368

MEDIUM 6.4

ClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete Routes

CVSS Score

6.4

EPSS Score

0.0%

EPSS Percentile

0th

ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another course's submission UUID to PUT or DELETE handlers to overwrite answers, grades, feedback, and grading status or delete submissions.

CWE	CWE-639
Vendor	classroomio
Product	classroomio
Published	Oct 15, 2026

Stay Ahead of the Next One

Get instant alerts for classroomio classroomio

Be the first to know when new medium vulnerabilities affecting classroomio classroomio are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

Low

Affected Versions

classroomio / ClassroomIO

0 ≤ 1.0.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@hieuPenguinnn/classroomio-course-resource-id-scoping-idor github.com: https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/routes/course/submission.ts github.com: https://github.com/classroomio/classroomio/blob/v1.0.0/packages/db/src/queries/submission/submission.ts#L217-L245 github.com: https://github.com/classroomio/classroomio/commit/1844ad9671a0d9c2566d3431d82f34d39016242c github.com: https://github.com/classroomio/classroomio vulncheck.com: https://www.vulncheck.com/advisories/classroomio-through-1.0.0-idor-via-course-submission-update-grade-and-delete-routes

Credits

hieuPenguinnn