TI-2026-75098 Aliases CVE-2026-111368

ClassroomIO lets tutors edit submissions in other courses via IDOR

MEDIUM 60CWE-639Published 2026-10-15 · Updated 2026-10-16

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Security bypass
Confidentiality · integrity · availability: Low · High · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

ClassroomIO through 1.0.0 has an insecure direct object reference in its Hono API course submission routes. A course tutor or admin can pair their own course id with another course's submission UUID in PUT or DELETE handlers, which lets them overwrite answers, grades, feedback and grading status or delete submissions in other courses. An authenticated user with low privileges can do this without user interaction. The weakness is classified as CWE-639.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another course's submission UUID to PUT or DELETE handlers to overwrite answers, grades, feedback, and grading status or delete submissions.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00291 21st percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
classroomio	ClassroomIO	up to 1.0.0	—	No fix listed	CNA

ClassroomIO Vendorclassroomio Affected up to 1.0.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for ClassroomIO.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

2026-10-16 Threatist record created from CVE-2026-111368
2026-10-16 CISA SSVC decision points changed

References

Patch 1

https://github.com/classroomio/classroomio/commit/1844ad9671a0d9c2566d3431d82f34d39016242c

Advisory 1

https://hackmd.io/@hieuPenguinnn/classroomio-course-resource-id-scoping-idor

Other 3

TI-2025-40417 An issue was discovered in classroomio 0.1.13. CVSS 3.1CRITICAL 9.1
TI-2025-40419 Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share… CVSS 3.1HIGH 7.5
TI-2025-40421 Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows… CVSS 3.1MEDIUM 5.4
TI-2025-40420 Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows… CVSS 3.1MEDIUM 5.4
TI-2025-40418 An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to… CVSS 3.1MEDIUM 4.3
TI-2025-41187 An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via… CVSS 3.1HIGH 8.1

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences