CVE Feed

    Dashboard / CVE / CVE-2026-111369

    CVE-2026-111369

    ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson ids to change titles and stored HTML content or delete lessons in their course and in other courses and organizations.

    Published:Oct 15, 2026
    Last Modified:Oct 16, 2026
    EPS:Oct 15, 2026
    EPSS Score:0.00246
    CVSS Score:7.1

    Affected Products

    Vendor
    Classroomio
    Product
    Classroomio

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-863 Incorrect Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-111368 (CVSS 6.1) — ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course su…
    CVE-2025-67259 (CVSS 6.5) — A Broken Access Control vulnerability exists in ClassroomIO v0.1.13 where an authenticated low-privileged "stu…
    CVE-2025-67298 (CVSS 8.1) — An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the endpoints /api/v…
    CVE-2025-65672 (CVSS 7.5) — Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share and invite access to c…
    CVE-2025-65676 (CVSS 5.4) — Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to ex…
    CVE-2025-65669 (CVSS 9.1) — An issue was discovered in classroomio 0.1.13. Student accounts are able to delete courses from the Explore pa…
    CVE-2025-65670 (CVSS 4.3) — An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to access sensitive admin/tea…
    CVE-2025-65675 (CVSS 5.4) — Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to ex…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High