CVE-2026-111369
ClassroomIO through 1.0.0 Incorrect Authorization via Lesson Update and Delete Routes
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
0th
ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson ids to change titles and stored HTML content or delete lessons in their course and in other courses and organizations.
| CWE | CWE-863 |
| Vendor | classroomio |
| Product | classroomio |
| Published | Oct 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for classroomio classroomio
Be the first to know when new high vulnerabilities affecting classroomio classroomio are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
Low
Affected Versions
classroomio / ClassroomIO
0 ≤ 1.0.0
References
hackmd.io: https://hackmd.io/@hieuPenguinnn/classroomio-course-resource-id-scoping-idor github.com: https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/routes/course/lesson.ts#L107-L152 github.com: https://github.com/classroomio/classroomio/blob/v1.0.0/apps/api/src/middlewares/course-member.ts github.com: https://github.com/classroomio/classroomio vulncheck.com: https://www.vulncheck.com/advisories/classroomio-through-1.0.0-incorrect-authorization-via-lesson-update-and-delete-routes
Credits
hieuPenguinnn