CVE Feed

    Dashboard / CVE / CVE-2026-111368

    CVE-2026-111368

    ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another course's submission UUID to PUT or DELETE handlers to overwrite answers, grades, feedback, and grading status or delete submissions.

    Published:Oct 15, 2026
    Last Modified:Oct 16, 2026
    EPS:Oct 15, 2026
    EPSS Score:0.00232
    CVSS Score:6.4

    Affected Products

    Vendor
    Classroomio
    Product
    Classroomio

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-111369 (CVSS 7.1) — ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId l…
    CVE-2025-67259 (CVSS 6.5) — A Broken Access Control vulnerability exists in ClassroomIO v0.1.13 where an authenticated low-privileged "stu…
    CVE-2025-67298 (CVSS 8.1) — An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the endpoints /api/v…
    CVE-2025-65672 (CVSS 7.5) — Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share and invite access to c…
    CVE-2025-65676 (CVSS 5.4) — Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to ex…
    CVE-2025-65669 (CVSS 9.1) — An issue was discovered in classroomio 0.1.13. Student accounts are able to delete courses from the Explore pa…
    CVE-2025-65670 (CVSS 4.3) — An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to access sensitive admin/tea…
    CVE-2025-65675 (CVSS 5.4) — Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to ex…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High