Classroomio vulnerabilities
Published CVEs affecting Classroomio products: 8 record(s), with severity, exploitation and fixes.
CVE-2026-111369
High · 7.1
CWE-863 Oct 15, 2026
ClassroomIO through 1.0.0 Incorrect Authorization via Lesson Update and Delete Routes
ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson ids to change titles and stored HTML content or delete lessons in their course and in other courses and organizations.
CVE-2026-111368
Medium · 6.4
CWE-639 Oct 15, 2026
ClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete Routes
ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another course's submission UUID to PUT or DELETE handlers to overwrite answers, grades, feedback, and grading status or delete submissions.
CVE-2025-67298
High · 8.1
CWE-290 Mar 11, 2026
Authentication Bypass by Spoofing in Classroomio
An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the endpoints /api/verify and /rest/v1/profile
CVE-2025-65670
Medium · 4.3
CWE-639 Nov 26, 2025
Authorization Bypass Through User-Controlled Key (IDOR) in Classroomio
An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating course IDs in URLs, resulting in unauthorized disclosure of sensitive course, admin, and student data. The leak occurs momentarily before the system reverts to a normal state restricting access.
CVE-2025-65676
Medium · 5.4
CWE-79 Nov 26, 2025
Cross-site Scripting (XSS) in Classroomio
Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG cover images.
CVE-2025-65675
Medium · 5.4
CWE-79 Nov 26, 2025
Cross-site Scripting (XSS) in Classroomio
Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG profile pictures.
CVE-2025-65672
High · 7.5
CWE-639 Nov 26, 2025
Authorization Bypass Through User-Controlled Key (IDOR) in Classroomio
Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share and invite access to course settings.
CVE-2025-65669
Critical · 9.1
CWE-862 Nov 26, 2025
Missing Authorization in Classroomio
An issue was discovered in classroomio 0.1.13. Student accounts are able to delete courses from the Explore page without any authorization or authentication checks, bypassing the expected admin-only deletion restriction.