classroomio vulnerabilities

Products

• classroomio/classroomio 9

Latest classroomio CVEs

Newest publication first

1. CVE-2026-124551 ClassroomIO through 1.0.0 Cross-Organization Course Disclosure via Clone Endpoint

   Published 2026-11-08

   Medium·CVSS 6.0 EPSS 0.26%

   ClassroomIO through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users of any organization to clone other tenants' courses via the POST /course/:courseId/clone endpoint. Attackers who know a target course id can copy its sections, lessons, exerci...

2. CVE-2026-111369 ClassroomIO through 1.0.0 Incorrect Authorization via Lesson Update and Delete Routes

   Published 2026-10-15

   High·CVSS 7.1 EPSS 0.25%

   ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson ids to change titles and stored HTML...

3. CVE-2026-111368 ClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete Routes

   Published 2026-10-15

   Medium·CVSS 6.1 EPSS 0.29%

   ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another course's submission UUID...

4. CVE-2025-67298 An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the endpoints /api/verify and /rest/v1/profile

   Published 2026-03-11

   High·CVSS 8.1 EPSS 0.25%

   An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the endpoints /api/verify and /rest/v1/profile

5. CVE-2025-65672 Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share and invite access to course settings.

   Published 2025-11-26

   High·CVSS 7.5 EPSS 0.38%

   Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share and invite access to course settings.

6. CVE-2025-65676 Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG cover images.

   Published 2025-11-26

   Medium·CVSS 5.4 EPSS 0.25%

   Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG cover images.

7. CVE-2025-65675 Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG profile pictures.

   Published 2025-11-26

   Medium·CVSS 5.4 EPSS 0.25%

   Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG profile pictures.

8. CVE-2025-65669 An issue was discovered in classroomio 0.1.13. Student accounts are able to delete courses from the Explore page without any authorization or authentication checks, bypassing the expected admin-only d...

   Published 2025-11-26

   Critical·CVSS 9.1 EPSS 0.50%

   An issue was discovered in classroomio 0.1.13. Student accounts are able to delete courses from the Explore page without any authorization or authentication checks, bypassing the expected admin-only deletion restriction.

9. CVE-2025-65670 An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating course IDs in URLs, resulting in unauthorized disclosure of...

   Published 2025-11-26

   Medium·CVSS 4.3 EPSS 0.26%

   An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating course IDs in URLs, resulting in unauthorized disclosure of sensitive course, admin, and student data. The leak occurs momentarily before t...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.